Controller
Entity that determines purposes and means of data processing.
How the laws define this
Regulatory standards consistently define a controller as the natural or legal person, authority, or body that determines the purposes and means of processing and carries primary responsibility for legal compliance, including implementing security measures, establishing lawful bases, and respecting data subject rights. The most significant divergence lies in the scope of technology and shared oversight. While standard data privacy mandates like the Personal Data Protection Law (PDPL) (Royal Decree M/19) focus on personal data processing, Proyecto de Ley (Boletín 17112-19) explicitly applies to processing carried out by an AI system. Additionally, rules such as Organic Act No. 2004-63 on the Protection of Personal Data, Lög um persónuvernd og vinnslu persónuupplýsinga nr. 77/2018, and Law No. 21.719 expressly govern processing conducted alone or jointly with others. In contrast, instruments like Law No. 13 of 2016 Concerning Personal Data Privacy Protection (Personal Data Protection Law) and the Federal Act on Data Protection (FADP) do not explicitly mention joint determination.
Synthesised from the 11 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first. Showing 10 of the 11 instruments that define this term; all are listed under Definitions below.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| Saudi Arabia | Personal Data Protection Law (PDPL) (Royal Decree M/19) | In Force (Amended) | Explicitly includes authorities, agencies, or other bodies as potential controllers and details primary obligations like lawful bases, safeguards, registration, DPO appointment, and data subject rights responses. |
| Qatar | Law No. 13 of 2016 Concerning Personal Data Privacy Protection | In Force | Limits scope to electronic personal data processing and emphasizes primary responsibility for lawful, transparent handling under the Law. |
| Switzerland | Federal Act on Data Protection (FADP) — total revision | In Force | Includes public bodies alongside natural or legal persons and specifies primary responsibility for compliance with the Act's obligations. |
| Tunisia | Organic Act No. 2004-63 on the Protection of Personal Data | In Force | Explicitly allows controllers to act alone or jointly with others in determining purposes and means. |
| Iceland | Act on Data Protection and the Processing of Personal Data No. 77/2018 | In Force | Explicitly includes public authorities or agencies and allows controllers to act alone or jointly with others. |
| Senegal | Law No. 2008-12 on the Protection of Personal Data | In Force | Details primary responsibilities including recordkeeping, obtaining authorizations or declarations, and implementing security measures. |
| Indonesia | Law No.27/2022 on Personal Data Protection | In Force | Explicitly allows controllers to act alone or jointly with others and lists specific obligations like lawful basis, notice, and data subject rights. |
| France | Law No. 2018-493 of 20 June 2018 - Law on the Protection of Personal Data | In Force (Amended) | Explicitly includes public authorities, agencies or other bodies and details responsibilities like legal bases, data subject rights, security, record-keeping, and CNIL interaction. |
| Chile | Law No. 21.719 — Regulates the protection and processing of personal data and creates the Personal Data Protection Agency | Awaiting Entry | Details primary responsibilities including security measures, data-subject rights responses, and maintaining records of processing activities. |
| Switzerland | Data Protection Ordinance (DPO) — implementing ordinance to the revised FADP | In Force | Emphasizes primary responsibility for implementing appropriate technical and organisational measures to ensure compliance. |
What it triggers
- Under the Saudi Arabia PDPL, controllers bear primary obligations including ensuring lawful bases for processing, implementing safeguards, registering when required, appointing a DPO if mandated, and responding to data subject rights.
- In Qatar under Law No. 13 of 2016, controllers bear primary responsibility for complying with processing obligations and ensuring lawful, transparent handling of electronic personal data.
- In Switzerland under the revised FADP, controllers bear primary responsibility for compliance with the Act's obligations.
- Under the Swiss Data Protection Ordinance, controllers bear primary responsibility for ensuring compliance with data protection obligations, including implementing appropriate technical and organisational measures.
Definitions (11)
The natural or legal person, authority, agency, or other body that determines the purposes and means of personal data processing. Controllers bear primary obligations under the PDPL, including ensuring lawful bases for processing, implementing safeguards, registering when required, appointing a DPO if mandated, and responding to data subject rights.
The entity that determines the purposes and means of processing carried out by an AI system and thus bears responsibility for ensuring compliance with rights-protecting obligations, including coordination with data protection rules when personal data is processed.
The natural or legal person who determines the purposes and means of processing personal data under the Law, bearing primary responsibility for complying with processing obligations and for ensuring lawful, transparent handling of electronic personal data.
A natural or legal person or public body that determines the purposes and means of processing personal data and bears primary responsibility for compliance with the Act's obligations.
The natural or legal person that determines the purposes and means of processing personal data and bears primary responsibility for ensuring compliance with data protection obligations, including implementing appropriate technical and organisational measures.
The natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data and bears responsibility for complying with the Act's obligations.
The natural or legal person, public authority, or agency which, alone or jointly with others, determines the purposes and means of the processing of personal data.
The person or entity who determines the purposes and means of processing personal data and is primarily responsible for ensuring that processing complies with legal obligations, including recordkeeping, obtaining authorizations/declarations, and implementing security measures.
The natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data and bears primary responsibility for compliance with the law, including implementing security measures, responding to data-subject rights, and maintaining records of processing activities.
The person or legal entity that alone or jointly with others determines the purposes and means of processing personal data and bears primary responsibility for compliance with the Act's obligations, including lawful basis, notice, and data subject rights.
The natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing personal data; responsible for ensuring compliance with legal bases, data subject rights, security measures, record-keeping and interaction with the CNIL. The law adopts the GDPR-aligned definition while preserving national statutory references.
Not to be confused with
A processor acts on behalf of the controller to process data, while the controller determines the purposes and means of processing.
This term carries the same core meaning but these definitions provide jurisdiction-specific nuances and obligations.
Questions and answers
What obligations do controllers have under the Saudi PDPL?
Controllers must ensure lawful bases for processing, implement safeguards, register when required, appoint a DPO if mandated, and respond to data subject rights.
Does controller status allow joint determination of processing?
Yes, several definitions including Tunisia, Iceland, Indonesia, and France explicitly state that controllers can determine purposes and means alone or jointly with others.
What technical duties apply to controllers in Switzerland?
Under the Data Protection Ordinance, controllers must implement appropriate technical and organisational measures to ensure compliance.
Related Terms
Data controller/processor
Entities determining or processing personal data for AI systems....
Data controller
Entity that determines purposes and means of processing....
Controller (Responsable)
Entity determining purposes and means of processing....
Processor
Entity that processes data on behalf of the controller....
Controller (responsible party)
Entity determining purposes and means of processing....