UK GDPR Controller and Processor Status

Define one processing activity at a time, then ask who decides why it happens and the essential means: which personal data and people are in scope, who receives the data, how long it is kept, and the main processing operations. A party that makes those decisions is a controller. Parties that make them together are joint controllers. A party that processes only on another controller's documented instructions is a processor.

The same organisation can hold different roles for different activities. For example, a hosting provider may be a processor for customer content but a controller for its own workforce administration or independently determined fraud-prevention processing. Split those activities instead of assigning one label to the entire commercial relationship.

The business owner should describe the service and decisions; privacy or legal should challenge the classification; procurement should align the contract; and engineering or operations should confirm the data flow and instruction controls. Record the conclusion per processing purpose, not only per vendor.

Evidence should include the data-flow map, decision-rights matrix, service description, instructions, Article 28 clause map where applicable, subprocessor list, joint-controller arrangement where applicable, privacy-notice treatment, and review triggers.

A processor can choose non-essential technical details while remaining a processor, but independent decisions about the purpose or essential means point to controller status. Commercial influence, access to data, or drafting the contract does not by itself settle the role.

Joint participation does not always mean joint control. The parties must jointly determine purposes and means for the same processing. Sequential or connected processing can still involve separate controllers when each party decides its own purpose and means.

Classify each distinct use. A cloud provider may be a processor when it stores customer records on instructions and an independent controller when it uses account contacts for its own billing or fraud controls. The result follows the actual decision rights and processing, not the product label.

For a controller-to-processor activity, Article 28 requires a binding contract or other legal act describing the processing and setting the listed instruction, confidentiality, security, subprocessor, assistance, deletion or return, and audit duties. Controllers must use processors that provide sufficient guarantees.

For joint control, document the transparent allocation of responsibilities and provide the essence to people. For separate controllers, document the disclosure purpose, lawful basis, transparency, security, rights handling, and any transfer restriction without misusing an Article 28 contract.

A general written subprocessor authorisation must require the processor to tell the controller about intended additions or replacements so the controller can object. A processor must also tell the controller if, in its opinion, an instruction infringes the UK GDPR or other applicable UK data-protection law.