What is a data controller?
A data controller is the person, company, public body or other organization that determines the purposes and means of processing personal data. Purposes are the why: billing customers, running payroll, targeting ads. Means are the main parts of the how: which data is collected, from whom, how long it is kept and who receives it. The term comes from the EU's General Data Protection Regulation (GDPR), Article 4(7), and other privacy laws use the same idea under other names; California's law, for example, speaks of a business and its service providers.
A controller can hand the work to processors and let them choose technical details such as which servers or software to use, but it can't hand over the accountability.
What a controller must do
- Have a lawful basis, such as consent, a contract or a legal obligation, for each processing purpose.
- Tell people what is collected and why, and honor their rights to access, correction, erasure and portability.
- Build data protection into systems by design and by default, and run a data protection impact assessment before high-risk processing.
- Apply security appropriate to the risk and keep records of its processing activities.
- Use only processors that give sufficient guarantees, under a written contract.
- Notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, and tell affected people directly when the risk to them is high.
Serious violations can bring fines of up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher.
Example: a breach at a vendor
A fitness club chain decides to collect members' visit history to send personalized class offers, which makes it the controller. It uses an email platform to send the offers, and the platform is a processor. On a Monday morning the platform discovers that an attacker accessed its customer lists and informs the chain that afternoon. The chain, not the platform, assesses the risk to its members. Because the lists include names, email addresses and visit patterns, it notifies its supervisory authority on Thursday morning, inside the 72-hour window counted from when it became aware, and reviews whether the platform met its contract terms.
Joint controllers and controllers by conduct
Two organizations that decide purposes and means together are joint controllers and must set out their respective duties in an arrangement between them, as with two companies running a co-branded loyalty program. A vendor can also become a controller through its own conduct: a processor that starts using a client's data for its own purposes, such as improving its own products, is treated as a controller for that processing.
Data controller vs. processor, owner and DPO
- Data processor: a separate organization that processes personal data on the controller's behalf and only on its instructions.
- Data owner: the senior person inside an organization who is accountable for a data set. The fitness chain is the controller; its head of marketing may own the member mailing list.
- Data protection officer (DPO): advises the organization and monitors compliance, but doesn't decide the purposes of processing.
- Data subject: the person the data is about.
Data controller on the CompTIA Security+ exam
Data roles fall under SY0-801 objective 3.3, which covers knowing what data an organization holds and how it is protected. Wording such as "determines the purpose and means of processing", "decides what personal data to collect and why" or "must notify the supervisory authority of the breach" points to the controller. Distractors include the data processor, which acts on instructions; the data owner, an internal role; the data custodian; the DPO; and the data subject.