What is a data controller? What do they do?

Contents

• What Does a Data Controller Do?

• Data Controllers’ Responsibilities

• Data Controllers Vs. Data Processors

• Conclusion

What Does a Data Controller Do?

A data controller does exactly that. It is the legal entity that decides the purposes for which personal data is collected and processed, and has a key role in the oversight of that data processing. In summary their core duties are:

Determining the purposes and means of data processing

They decide why and how personal data will be used. This could be anything from fulfilling customer orders to analysing website traffic for marketing purposes. Because of this they decide what personal data is needed and initiate data collection.

Identifying the legal basis for processing

The GDPR requires lawful justification for processing data. The data controller must determine and document which lawful basis applies, such as consent, contractual obligation, or legitimate interest.

Implementing appropriate technical and organisational measures

They are responsible for ensuring data security and implementing technical and organisational measures to protect against unauthorised access, alteration, or deletion of personal data. This means having the right kind of systems in place to ensure adequate data protection or data privacy and ensuring employees and staff understand their GDPR responsibilities.

• find out more about data breaches here.

Appoints a Data Protection Officer (DPO)

A DPO acts as an internal expert on data protection, advising and overseeing compliance efforts. For many organisations, like any public authority, having a DPO is a statutory obligation. However, a DPO is recommended for all organisations that collect and process personal data.

Complies with Data Subjects’ Rights

Individuals have rights to access, rectify, erase, restrict, and object to processing their data. The data controller must have procedures in place to respond to these requests promptly and effectively.

Reports data breaches to the supervisory authority

If a data breach occurs that poses a risk to individuals’ rights and freedoms, the data controller must notify the relevant authority within a specific timeframe.

Appoint and Oversee Data Processors

The data controller will set up a controller / processor contract to enable data processing by authorised parties. Data controllers are responsible for the conduct of data processors, and may also be liable for any data breaches by those data controllers.

Data Controllers’ Responsibilities

• Compliance with the GDPR: They are ultimately accountable for ensuring their data processing practices comply with the GDPR, and abide by the data protection principles. Non-compliance can lead to a large fine and reputational damage.

• Transparency and accountability: The data controller must be transparent about its data processing activities and accountable to individuals whose data it holds. They have a statutory obligation to set out the purposes for which they collect and process personal data. This is largely done through a privacy statement.

• Respecting individual rights: They must uphold the rights of data subjects (any person whose personal information they collect and process), ensuring they have control over their personal information.

Remember:

• The concept of a joint controllers exists, where two or more organisations jointly make decisions about the purposes and means of processing.

• Data processors also play a crucial role, acting on behalf of the controller and processing data according to their instructions.

• Understanding and fulfilling the data controller role is essential for any organisation handling personal data under the GDPR.

Data Controllers Vs. Data Processors

While the data controller takes center stage, orchestrating data processing under the GDPR, data processors play a crucial supporting role by following the controller’s instructions and maintaining data security.

Key Data Processor Functions

The core functions of a data processor are to:

• Act on behalf of the data controller: Processors carry out specific data processing tasks as instructed by the controller, such as storing, analysing, or transmitting data.

• Be bound by contractual obligations: A formal agreement outlines the processor’s responsibilities, ensuring they comply with the controller’s instructions and the GDPR’s requirements.

• Implement appropriate security measures: Processors must take adequate technical and organisational measures to protect personal data from unauthorised access, alteration, or loss.

• Only process data for authorised purposes: They are prohibited from using personal data for their own purposes or beyond the agreed-upon scope.

• Assist with data subject rights requests: Processors must assist the controller in responding to individuals’ requests regarding their personal data.

• Report data breaches to the data controller: If a data breach occurs, processors must inform the controller without undue delay.

Remember:

• Processors share some responsibility with the controller for ensuring GDPR compliance.

• They should have expertise in data security and relevant legal requirements.

• Choosing reliable and compliant processors is crucial for data controllers.

While less visible than the data controller, processors play a critical role in the GDPR ecosystem. By fulfilling their responsibilities diligently, they help ensure the responsible and secure processing of personal data. This contributes to a data protection landscape that respects individual rights and organisational needs.

Conclusion

Every organisation will be either a data controller or a data processor. By taking ownership of their responsibilities data controllers can ensure compliance with statutory obligations when processing personal data. In essence, the data controller acts as the conductor of the data processing orchestra. Their expertise, planning, and adherence to the GDPR’s guidelines ensure the smooth and responsible use of personal data, safeguarding individual privacy while achieving organisational objectives.