The distinction turns on who decides the purposes and means of processing. Getting it wrong means the wrong contract, the wrong record, and obligations sitting with the wrong party.
Article 4(7) defines a controller as the body which, alone or jointly with others, determines the purposes and means of the processing. Article 4(8) defines a processor as one which processes personal data on behalf of the controller.
The whole distinction sits in those two phrases. Everything else follows from which side of them you are on.
The test in practice
The ICO puts it directly: if you exercise overall control of the purpose and means, deciding what data to process and why, you are a controller. If you have no purpose of your own and act only on a client's instructions, you are likely a processor, even where you make some technical decisions about how the processing happens.
That last clause matters. A hosting provider choosing which servers to use, or a SaaS vendor designing its own database schema, is making technical decisions about means without becoming a controller. The question is whether you decide the purpose.
The arrangements that catch people out
| Arrangement | Usual position |
|---|---|
| Payroll bureau processing your staff data to your instructions | Processor for that work, though a bureau with its own statutory duties may be a controller for those |
| A SaaS product you use to hold customer records | Processor for your customer data, controller for its own account and billing data about you |
| An analytics provider that also uses the data to improve its own product | Controller for that additional purpose, because the purpose is its own |
| A professional adviser exercising independent judgement | Usually a controller, because the purpose is set by their professional role rather than your instruction |
The pattern in the last two rows is worth naming. A party that starts as a processor becomes a controller for any purpose it decides on itself. This is not a status you hold overall, it is a status per processing activity.
The label in the contract does not settle it. If the arrangement gives a party its own purpose, that party is a controller for that purpose whatever the agreement says.
What changes with the answer
Controllers carry the highest compliance burden. They must comply with, and demonstrate compliance with, all the data protection principles and the wider obligations. Processors have a narrower set of direct duties, but they are real duties owed under the regulation rather than only under the contract.
Three concrete differences:
- 1The record of processing differs. A controller keeps the Article 30(1) list; a processor keeps the shorter Article 30(2) list, which names each controller it acts for.
- 2The contract is mandatory. Article 28(3) requires a binding written contract with eight specified obligations, and Article 28(2) requires prior written authorisation before a processor engages a sub-processor.
- 3Data subject rights land with the controller. A processor receiving a subject access request passes it on rather than answering it.
If you are both, and most organisations are
An agency is a controller for its own staff and prospects, and a processor for the client data it handles. Both roles need their own record. Writing one record that blends them produces a document that answers neither Article 30(1) nor 30(2) properly.
How EmberHound fits
Whichever role applies, the underlying question is the same: what personal data do you actually hold, and where. EmberHound scans enrolled company devices and reports that by category and location, which feeds both the controller record and the processor record without needing to be gathered twice.
It does not classify your role. That judgement depends on the arrangement and belongs with your DPO or legal adviser.
This article is general information, not legal advice. Confirm the obligations that apply to your organisation before acting on it.
Sources & references
- Article 4 - Definitions, UK GDPR - legislation.gov.uk
- Article 28 - Processor, UK GDPR - legislation.gov.uk
- Controllers and processors - ICO
