# Data controller

> A data controller is the organisation or person that decides why and how personal data is processed. Under GDPR the controller carries the primary legal…

Source: https://northerngo.com/glossary/data-controller/
Language: en
Updated: 2026-08-28

---
**A data controller is the organisation or person that decides why and how personal data is processed. Under GDPR the controller carries the primary legal responsibility: choosing a legal basis, informing individuals, answering their requests and reporting breaches, even when the actual processing is done by someone else.**

### Determining purposes and means

The test is not who holds the data or who wrote the code. It is who decides. If you choose what to collect, why you collect it, how long to keep it and who else gets to see it, you are the controller — even if every byte lives on someone else's servers.

Concretely, the controller must:

- establish and document a legal basis for each purpose,
- give individuals clear information about the processing,
- handle access, correction, erasure and portability requests,
- report qualifying personal data breaches to the supervisory authority, normally within 72 hours,
- and appoint each [data processor](/glossary/data-processor/) under a written agreement, having checked they offer sufficient guarantees.

### The role people get backwards

This is the most common confusion in the whole area, and it usually goes one way: someone builds an app on a platform and assumes the platform is the controller because the platform stores the data.

It is normally the other way round. **If you build an app and decide to collect your users' email addresses and order history, you are the controller. The platform that hosts it acts on your instructions and is your processor.** A hosting provider, an app builder or a database service does not decide why your users' data exists, so it is not the controller for it — and that means the obligations towards your users sit with you.

Two related cases are worth knowing. **Joint controllers** exist where two parties genuinely decide together, and they must agree in writing who does what. And a processor that starts using the data for its own purposes — analytics for product development, model training — becomes a controller for that processing, with its own obligations.

### Why it matters practically

The controller is who a regulator contacts and who a user sues. It also determines who has to answer an erasure request under [GDPR](/glossary/gdpr/) article 17 — which is why an app with login needs a real account deletion path rather than a support email.

This is an explanation of the concept, not legal advice.

---

NorthernGo is an AI-powered platform for building production-ready web apps with zero coding. Local AI generation via WebGPU is unlimited and free, and you own all generated source code. https://northerngo.com/