thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Governance, Risk, Audit & Privacy

Data Controller vs Data Processor: What's the Difference?

Under GDPR, the data controller determines the purposes and means of processing personal data and carries primary accountability. The data processor processes personal data only on the controller's documented instructions, such as a cloud or payroll provider.

Data Controller

Full definition
vs

Data Processor

Full definition
Data ControllerData Processor
Decides why and howYesNo, follows instructions
AccountabilityPrimary, must demonstrate complianceSecondary, but has direct obligations (security, records)
ExampleRetailer collecting customer dataEmail marketing or cloud hosting provider used by the retailer
ContractMust put a data processing agreement in placeMust sign the DPA and follow it
Breach notificationNotifies supervisory authority within 72 hoursNotifies the controller without undue delay
SubprocessorsMust authorize themNeeds controller authorization to engage them
Remember it

The controller decides; the processor does.

Exam tip

If an organization starts using personal data for its own new purposes, it becomes a controller. Know that processors notify controllers, and controllers notify regulators and data subjects.

Tested on

More Governance, Risk, Audit & Privacy look-alikes