Who's who: data subjects, controllers and processors

By the end of this lesson you can name the data subject, the controller and the processor, and say who is responsible for what.

Why it matters

When data is misused, the first question a regulator asks is "whose job was it to protect it?" The law answers that with three roles. Get the roles right and you know who must register, who must answer a complaint, and who pays a fine. Get them wrong and a business either carries a duty it did not know it had, or assumes someone else was responsible when nobody was.

The idea in plain words

Picture a restaurant. The diner is the person the meal is for. The owner decides the menu, the prices and how the kitchen runs. A contract cleaning firm comes in at night and does exactly what the owner tells them. Data has the same three parts.

The data subject is the living person the data is about. The data is theirs, in the sense that the rights belong to them. The controller is the organisation that decides why personal data is used and how. It is in charge, so it carries most of the duties. The processor is a separate organisation that handles the data only on the controller's instructions, like a cloud provider that stores the files but does not decide what they are for.

Data subject the person Controller decides why and how Processor acts on instructions

The controller is in charge and carries most of the duties. The processor only does what the controller tells it.

Data subject: the living person the personal data is about. The rights in this course belong to them.

Controller: the organisation that decides the purposes and means of processing, that is, why the data is used and how. It carries most of the legal duties. (GDPR Article 4(7); the NDPA uses the same idea.)

Processor: an organisation that processes personal data on the controller's behalf and only on its instructions, such as a payroll bureau or a cloud host. (GDPR Article 4(8).)

See it done

A state health insurance agency keeps records of the people it covers. It uses an outside cloud company to store those records, and a separate text-message company to send appointment reminders. Who is who?

• The data subjects are the insured people whose records these are.
• The controller is the health insurance agency. It decides why the data is held (to run the scheme) and how.
• The processors are the cloud storage company and the text-message company. They handle the data, but only to do what the agency asked. They do not decide the data's purpose.

Notice the test. To find the controller, ask "who decided why this data is used?" To find a processor, ask "who is just following those instructions?"

Your turn, with help

A small school hires an accountant to run its staff payroll. The accountant uses accounting software from a third company.

1. Who is the controller of the payroll data?
2. What is the accounting software company?

Hints: Who decided that payroll would be run and why? Who only provides a tool used on instructions?

Your turn, alone

1. A bank uses a debt-collection firm that decides for itself how to trace customers. Is the debt-collection firm a processor or a controller here?
2. Two hospitals jointly run one shared patient register and decide together how it works. What are they to each other?
3. You personally keep a contacts list on your phone for your own private use. Are you a controller under the law?

Watch out

• A processor that starts deciding purposes becomes a controller, and takes on a controller's duties. The label follows the behaviour, not the contract's title.
• "Joint controllers" exist. When two organisations decide together why and how data is used, they share the duties.
• A purely personal, household activity is usually outside these rules. Your private phone contacts are not caught; a business's contact list is.

Say it back

1. Which role decides why and how data is used?
2. Which role carries most of the legal duties?
3. What is the quickest test to tell a controller from a processor?

What is next

We have the people. Next we pin down the thing they do: what the law means by "processing", which turns out to be almost everything, including simply holding data and deleting it.