UK GDPR Controller or Processor?

Map the data flow and ask who decided to collect or use the personal data, the outcome the processing is meant to achieve, which people and data are in scope, who receives the data, and how long it is kept. Those purpose and essential-means decisions point to controller status. A provider may still be a processor while choosing practical technical details, such as the software or security method used to carry out the controller's instructions.

Two parties are joint controllers only when they jointly determine the purposes and means of the same processing. Parties are not joint controllers merely because they exchange the same data or work toward related commercial goals. Employees acting within their duties are part of the controller rather than separate processors.

The controller is responsible for the lawfulness and fairness of the processing, transparency, rights handling, security, accountability, breach decisions, and choosing processors that give sufficient guarantees. Article 28 requires a binding processor contract or other legal act containing the required terms.

A processor has direct UK GDPR duties. It must follow documented instructions unless UK law requires otherwise, keep data confidential, apply Article 32 security, control sub-processors, assist the controller with rights, security, breach, DPIA, and prior-consultation duties, return or delete data at the end as instructed, and provide compliance information and allow audits. A processor needs the controller's prior specific or general written authorisation before appointing a sub-processor.

Do not classify a cloud or professional-services provider once and reuse the answer for every feature. Hosting to a customer's instructions may be processor activity, while a provider's independent fraud, billing, product-development, or legal-compliance use may make it a controller for that separate processing. The answer depends on the actual facts and the authority each party exercises.