GDPR Data Controller Definition: Duties, Breaches, and Fines

Under the GDPR, a data controller is the person, company, public authority, or other body that decides why personal data is collected and how it is handled. That definition sits in Article 4(7) of the regulation and is the trigger for nearly every compliance duty the GDPR imposes.¹ If your organization collects customer emails, tracks EU website visitors, or keeps employee records, you are almost certainly a controller for at least some of that data.

The Purposes and Means Test

Article 4(7) describes the controller as the entity that “alone or jointly with others, determines the purposes and means of the processing of personal data.”¹ Two words do all the work: purposes and means. Whoever decides why data is collected and how it gets handled is the controller, whether or not that entity ever touches the data itself.

The purpose question is straightforward. What goal does the processing serve? A company that decides to collect email addresses for a weekly newsletter has set the purpose. A hospital that decides to run an automated system to manage patient queues has set the purpose.

The means question is trickier because not every technical decision creates controller status. Decisions closely tied to the purpose — which categories of personal data to collect, how long to keep it, who gets access, which individuals the data covers — point to controller status. Purely operational choices, such as which cloud provider or server brand to use, do not. A firm that decides to collect browsing habits, sets a two-year retention period, and defines which visitors to target is the controller, even if a third-party platform stores everything.

Article 4(7) also notes that where processing purposes and means are set by Union or Member State law, the controller may be designated by that law.¹ Tax authorities, for instance, are controllers over taxpayer data because a statute says so.

Who Can Be a Controller

The definition is deliberately broad and covers natural persons, legal persons, public authorities, agencies, and “other bodies.” In practice:

A freelance consultant maintaining a client contact database is a controller.
Any business collecting customer, employee, or supplier data is a controller.
A charity collecting donor information is a controller.
Government agencies processing data for public services, tax administration, or law enforcement are controllers.

Legal form is secondary. What matters is who actually decides. An informal association with no legal personality can still be a controller if it sets the purposes and means of processing.

Controller Versus Processor

The GDPR draws a sharp line between the two roles, and getting it wrong has real consequences. A processor is any entity that handles personal data on behalf of a controller.¹ The controller calls the shots; the processor follows documented instructions.

Take a gym that sends its membership mailing list to a printing company to produce addressed event invitations. The gym decided to collect the addresses, run the event, and pick who gets invited. The gym is the controller. The printer is the processor. If the printer started using that list for its own marketing, it would become a controller for that new activity and pick up all the duties that come with the role.

Controllers carry the heavier compliance burden and remain accountable for how their processors handle data. Processors have narrower obligations but are not off the hook, and either party can be fined for security failures.²

Joint Controllers

When two or more entities jointly decide the purposes and means of processing, they become joint controllers under Article 26. They have to put a transparent arrangement in place setting out each party’s responsibilities, particularly for data subject rights and for the privacy information required under Articles 13 and 14. The essence of that arrangement has to be made available to the people whose data is involved.³

Here is what catches many organizations off guard. Regardless of what the internal arrangement says, individuals can exercise their rights against any joint controller. If someone asks Controller B to delete their data, Controller B cannot refuse by pointing to a contract that assigns deletion to Controller A. The individual chooses which door to knock on.³

Liability follows the same logic. Under Article 82, each joint controller can be held liable for the entire amount of damage caused by joint processing. A controller that pays in full can then claim back the others’ shares, but the injured individual never has to sort out who owes what. Escaping liability requires proving the controller was “not in any way responsible for the event giving rise to the damage,” which is a high bar.⁴

What a Controller Has to Do

Being a controller triggers a cascade of duties that start with Article 5 and run through the rest of the regulation.

Follow the Processing Principles

Article 5 requires personal data to be processed lawfully, fairly, and transparently. Data must be collected for specific, clearly stated purposes and not reused in ways incompatible with them. Collection has to be limited to what is genuinely necessary, data must be kept accurate and up to date, and it cannot be retained longer than needed. The controller bears the burden of demonstrating compliance with all of these principles, a concept the regulation calls accountability.⁵

Pick a Legal Basis Before Processing

Lawful processing requires more than good intentions. Article 6 lists six legal bases, and every processing activity must rest on at least one:⁶

Consent: clear, informed agreement for a specific purpose.
Contractual necessity: processing needed to perform a contract with the individual or take pre-contractual steps at their request.
Legal obligation: processing required by law, such as keeping payroll records for tax compliance.
Vital interests: processing necessary to protect someone’s life.
Public interest: processing needed for a task in the public interest or under official authority.
Legitimate interests: a legitimate interest of the controller or a third party, unless overridden by the individual’s rights, particularly for children.

Controllers must identify and document the applicable basis before they start. Switching bases later is extremely difficult and, in many supervisory authorities’ view, not permitted. Getting this wrong is one of the fastest routes to a fine under the higher penalty tier.

Keep Records and Prove Compliance

Article 24 requires controllers to put technical and organizational measures in place that demonstrate compliance, not just achieve it. In practice that means internal policies, audits, and documentation of how personal data is handled.⁷

Article 30 layers on a duty to maintain records of processing activities, including categories of data, purposes, recipients, and retention periods. Organizations with fewer than 250 employees are generally exempt, but only if their processing is occasional, does not involve sensitive categories, and is unlikely to pose a risk to individuals’ rights. Most organizations that handle customer or employee data routinely will not qualify.

Appoint a DPO When Required

Article 37 requires a data protection officer in three situations: when the controller is a public authority, when its core activities involve large-scale regular and systematic monitoring of individuals, or when its core activities involve large-scale processing of sensitive data categories such as health or criminal-record information.⁸ Appointing a DPO voluntarily, even when not required, can help demonstrate accountability.

Honoring Individual Rights

Chapter 3 of the GDPR sets out a group of rights the controller has to facilitate. These are not optional courtesies; failure falls into the higher fine tier.

Access (Article 15): confirmation of whether data is being processed, plus a copy.
Rectification (Article 16): correction of inaccurate data or completion of incomplete data.
Erasure (Article 17): deletion in certain circumstances, often called the right to be forgotten.
Restriction (Article 18): pausing processing while accuracy or lawfulness is disputed.
Data portability (Article 20): receiving data in a structured, machine-readable format and moving it to another controller.
Objection (Article 21): objecting to processing based on legitimate interests or public interest grounds.
Protection from automated decisions (Article 22): the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

Controllers also have to inform individuals proactively about how their data is collected and used, under Articles 13 and 14. Responses to rights requests generally have to come within one month.

Reporting a Breach Within 72 Hours

When a personal data breach happens, the controller has to notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. The duty applies unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. A late notification has to come with an explanation for the delay.⁹

The notification has to describe the nature of the breach, the approximate number of individuals and records affected, the likely consequences, and the measures taken or proposed. When a breach is likely to create a high risk to individuals, the controller also has to notify affected individuals directly, in clear and plain language. Direct notification is not required if the controller had already applied protective measures such as encryption that render the data unintelligible, or has since taken steps that eliminate the high risk.¹⁰

Contracts With Processors

A controller cannot hand data to a third party and walk away. Article 28 requires a binding contract with any processor that handles personal data on the controller’s behalf, and supervisory authorities routinely check whether these agreements exist and contain the required terms.¹¹

At a minimum, the contract has to cover:

Subject matter, duration, nature, and purpose of the processing, plus the types of data and categories of individuals.
Processing only on the controller’s documented instructions.
A duty of confidence for anyone with access to the data.
Security measures meeting the Article 32 standard.
Rules on sub-processors: no engagement without the controller’s prior written authorization, whether specific or general, with notification and an opportunity to object under general authorization.
Assistance in responding to individuals exercising their rights.
What happens to the data when the relationship ends.

If a processor brings in a sub-processor, the original processor remains fully liable to the controller for that sub-processor’s compliance. That chain of liability is one of the GDPR’s most effective tools for stopping controllers from diluting accountability through outsourcing.¹¹

Security and Impact Assessments

Article 32 requires controllers and processors to implement technical and organizational security measures matched to the risk. The regulation lists specific examples: encryption and pseudonymization, ongoing confidentiality and resilience of systems, the ability to restore data quickly after an incident, and regular testing of the measures in place.¹²

High-risk processing calls for more. Article 35 requires a data protection impact assessment when processing involves automated profiling producing legal effects, large-scale processing of sensitive data categories, or systematic large-scale monitoring of publicly accessible areas. The assessment has to evaluate necessity, proportionality, risks to individuals, and the measures planned to address them.¹³

What Non-Compliance Costs

The GDPR uses a two-tier fine structure. The lower tier covers violations of controller and processor obligations and related rules (Articles 8, 11, 25–39, 42, and 43). Fines can reach 10 million euros or 2% of total worldwide annual turnover from the preceding year, whichever is higher.²

The upper tier is reserved for the most serious violations: breaches of the core processing principles, consent conditions, data subject rights, and international transfer rules. Fines can reach 20 million euros or 4% of worldwide annual turnover, whichever is higher. Ignoring a supervisory authority’s order also falls into this tier.²

Beyond administrative fines, Article 82 gives individuals a right to compensation for material or non-material damage caused by a GDPR violation. Private claims are growing alongside regulatory enforcement, so the financial exposure for a controller that gets the basics wrong can be substantial.⁴

1
GDPR-Info.eu. Art. 4 GDPR Definitions
2
General Data Protection Regulation (GDPR). Art. 83 GDPR General Conditions for Imposing Administrative Fines
3
General Data Protection Regulation (GDPR). Art. 26 GDPR Joint Controllers
4
General Data Protection Regulation (GDPR). Art. 82 GDPR Right to Compensation and Liability
5
General Data Protection Regulation (GDPR). Art. 5 GDPR Principles Relating to Processing of Personal Data
6
General Data Protection Regulation (GDPR). Art. 6 GDPR Lawfulness of Processing
7
General Data Protection Regulation (GDPR). Art. 24 GDPR Responsibility of the Controller
8
General Data Protection Regulation (GDPR). Art. 37 GDPR Designation of the Data Protection Officer
9
General Data Protection Regulation (GDPR). Art. 33 GDPR Notification of a Personal Data Breach to the Supervisory Authority
10
GDPR-Text.com. Art. 34 GDPR Communication of a Personal Data Breach to the Data Subject
11
General Data Protection Regulation (GDPR). Art. 28 GDPR Processor
12
General Data Protection Regulation (GDPR). Art. 32 GDPR Security of Processing
13
GDPR.info. Art. 35 GDPR Data Protection Impact Assessment