A data controller is a person, company, or other body that determines the purpose and means of personal data processing (this can be determined alone, or jointly with another person/company/body).

Can you be a controller and a processor under GDPR?

Can you be both a controller and a processor of personal data? Yes. … For example, you will have your own employees so you will be a controller regarding your employees’ personal data. However, you cannot be both a controller and a processor for the same processing activity.

What is a controller vs processor?

Answer. The data controller determines the purposes for which and the means by which personal data is processed. … The data processor processes personal data only on behalf of the controller. The data processor is usually a third party external to the company.