What is the difference between a controller and a processor under the GDPR?

The controller decides why and how personal data is processed; the processor processes it on the controller’s behalf and on its instructions. When your company uses a security service to monitor its network, your company is normally the controller of the network data and the vendor is the processor. The controller carries the main duties: a lawful basis, transparency towards the people concerned, answering their requests, deciding about breach notifications. The processor must follow your documented instructions, keep the data confidential and secure, use sub-processors only with your authorisation, help you with breaches and requests, and return or delete the data at the end. A contract, usually called a data processing agreement, sets this out. The roles depend on facts, not on labels: a vendor that uses your data for its own purposes becomes a controller for that use. For NetSenX, TriStiX S.L. acts as processor and your organisation as controller, as the published data processing agreement states.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on EU law: GDPR, DORA, CRA and AI ActAll topics