Data controller
A data controller is the organisation or person that decides why and how personal data is processed. Under GDPR the controller carries the primary legal responsibility: choosing a legal basis, informing individuals, answering their requests and reporting breaches, even when the actual processing is done by someone else.
Determining purposes and means
The test is not who holds the data or who wrote the code. It is who decides. If you choose what to collect, why you collect it, how long to keep it and who else gets to see it, you are the controller — even if every byte lives on someone else's servers.
Concretely, the controller must:
- establish and document a legal basis for each purpose,
- give individuals clear information about the processing,
- handle access, correction, erasure and portability requests,
- report qualifying personal data breaches to the supervisory authority, normally within 72 hours,
- and appoint each data processor under a written agreement, having checked they offer sufficient guarantees.
The role people get backwards
This is the most common confusion in the whole area, and it usually goes one way: someone builds an app on a platform and assumes the platform is the controller because the platform stores the data.
It is normally the other way round. If you build an app and decide to collect your users' email addresses and order history, you are the controller. The platform that hosts it acts on your instructions and is your processor. A hosting provider, an app builder or a database service does not decide why your users' data exists, so it is not the controller for it — and that means the obligations towards your users sit with you.
Two related cases are worth knowing. Joint controllers exist where two parties genuinely decide together, and they must agree in writing who does what. And a processor that starts using the data for its own purposes — analytics for product development, model training — becomes a controller for that processing, with its own obligations.
Why it matters practically
The controller is who a regulator contacts and who a user sues. It also determines who has to answer an erasure request under GDPR article 17 — which is why an app with login needs a real account deletion path rather than a support email.
This is an explanation of the concept, not legal advice.
Frequently asked questions
If I build an app on a platform, am I the controller or is the platform?
You almost always are. You decide what data your app collects, why, and how long it is kept, which is exactly the test for being a controller. The platform stores and processes it on your instructions, which makes it your processor. This is an explanation, not legal advice.
Build it yourself
NorthernGo turns a plain-text description into a working web app with a database, login and a live URL. Local AI generation runs on your own GPU, is unlimited, and is free on every plan.