Data controller and processor

Under UK GDPR the controller decides why and how personal data is used; the processor acts on the controller’s instructions. For a system we build and host for you, you are the controller of your customers’ data and we are a processor. That is a distinction with real consequences: the obligations to the customer are yours, and ours are to you, written down in a data processing agreement.

In practice

Under UK GDPR the controller decides why and how personal data is used; the processor acts on the controller’s instructions. For a system we build and host for you, you are the controller of your customers’ data and we are a processor, which is a distinction with real consequences: the obligations to the customer are yours, and ours are to you.

That relationship is supposed to be written down, which is what a data processing agreement is for — what we process, why, for how long, who else is involved, and what happens at the end.

It is also worth knowing where the data sits and who else touches it. Most modern systems involve a hosting provider, a database, an email sender and a payment provider, and each of those is a sub-processor that belongs on the list rather than being discovered during an incident.

Also called: UK GDPR, data processing agreement.

Questions people ask about data controller and processor

Am I the controller of my customers’ data?

If you decide why and how it is used, yes - which is the normal position for a business whose software is built or hosted by somebody else. The supplier acting on your instructions is the processor. The obligations to your customers sit with you, and the supplier’s obligations sit with you too.

What should a data processing agreement cover?

What is processed, why, for how long, who else is involved, what happens in an incident, and what happens to the data at the end of the relationship. The last one is the clause people wish they had read, because it decides whether leaving is an export or a rebuild.

What is a sub-processor?

Anyone your processor uses to do the work: the hosting provider, the database, the email sender, the payment provider. Each belongs on a written list that you have seen, rather than being discovered during an incident when somebody asks where the data actually sits.

Sources, checked 26 October 2026

Information Commissioner’s Office, Controllers and processors: who is who under UK GDPR, and what each is responsible for