Under GDPR you are a controller if you decide why and how personal data is processed, and a processor if you process it on a controller's behalf. Joint controllers decide purposes and means together. The label follows what you actually do, not what the contract says.
The definitions
Article 4 defines the controller as the party that, alone or with others, determines the purposes and means of processing. A processor processes personal data on behalf of the controller. That is all the text gives you, so the tests below are practical aids rather than quotations.
Two questions that sort most cases
- Who decides the purpose? If the data is used for your own goals, such as product improvement or marketing, you are acting as a controller for that use.
- Who decides the essential means? Which data, whose data, how long, who gets it. A party that follows documented instructions on those points looks like a processor.
A SaaS vendor is typically a processor for customer content it hosts and a controller for its own account and billing data. The same company can hold both roles for different datasets.
Joint controllers
Article 26 applies when two or more controllers jointly determine purposes and means. They must set out, in an arrangement, who does what, especially on handling individuals' rights and giving transparency information. The arrangement can name a contact point and its essentials must be made available to the people concerned. Whatever it says, an individual can exercise their rights against each joint controller.
What each role needs on paper
- Controller to processor: a binding contract with the Article 28 content. See the processor contract checklist.
- Joint controllers: a transparent arrangement under Article 26.
- Processor to sub-processor: the same obligations passed down by contract, with the controller's prior written authorisation.
A processor can become a controller
If a processor determines the purposes and means of processing in breach of the regulation, Article 28(10) treats it as a controller for that processing. A vendor that starts reusing customer data to train its own models without instructions is in this territory. Check your contracts and your behaviour.
Common mistakes
Calling everyone a processor to keep the paperwork light. If you set your own purposes, you carry controller duties.
Ignoring your own controller role. A processor still has duties of its own, including security and keeping a record of processing.
No data flow diagram. You cannot assign roles for flows you have not mapped.
Quick check
Is a payroll provider a controller or processor?
It depends on whether it follows your instructions or decides for itself how to use the data. Assess the facts and the contract.
Does naming a role in the contract settle it?
No. The roles follow the actual determination of purposes and means.
Sources
Last reviewed: 19 October 2026.
