Data Controller
The person or organisation that decides the purposes and means of processing personal data under UK GDPR. The controller carries the primary legal responsibility for complying with data protection law, even where it uses a processor to carry out the actual processing.
Independent editorial summary — not the official statute text. Read the official version on legislation.gov.uk.
The Information Commissioner's Office restates the UK GDPR's own definition directly: a '‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.' The test is functional rather than formal — it turns on who actually decides why and how personal data is processed, not on who happens to hold or store it.
That decision-making role carries real legal weight. ICO guidance explains that 'Controllers make decisions about processing activities. They exercise overall control of the personal data being processed and are ultimately in charge of and responsible for the processing.' A controller can be a company, another type of organisation, or an individual such as a sole trader — and where two or more organisations jointly decide the purposes and means of processing together, they become joint controllers, sharing that same overall responsibility.
Related terms
Official sources
This explanation is drawn from the official sources below; every substantive statement is verified against them. For advice on a specific matter, see our find help page.