Data controller
Entity that determines purposes and means of processing.
How the laws define this
Every listed regulatory framework agrees that a data controller is the person, legal entity, or public authority that determines the purposes and means of processing personal data, bearing primary legal responsibility for statutory compliance, security safeguards, and data subject rights. The main divergence lies in how these instruments scope controller status and procedural duties. Frameworks such as Law No. 058/2021, Personal Data Protection Act B.E. 2562 (2019), and Ley No. 81 de 26 de marzo de 2019 del Protección de Datos Personales explicitly encompass entities operating alone or jointly with others. Conversely, the Personal Data Protection (Amendment) Act 2024 establishes the term as a statutory replacement for 'data user' with specific requirements like appointing Data Protection Officers. Other instruments restrict the definition to context-specific entities, such as media houses under the Data Governance Guide for Media Practice in Kenya, or local authorities in the Bogotá TransMilenio AI Facial Recognition Pilot.
Synthesised from the 21 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first. Showing 10 of the 21 instruments that define this term; all are listed under Definitions below.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| Ecuador | Organic Law on the Protection of Personal Data (LOPDP) | In Force | Explicitly states controllers bear primary responsibility for compliance, safeguards, data subject rights, and accountability. |
| Malaysia | Personal Data Protection (Amendment) Act 2024 | In Force | Replaces prior 'data user' term and specifies duties to appoint Data Protection Officers plus governance, notification, and record-keeping. |
| Peru | Project 7619/2023 (07619) — Bill on interoperability and the use of Artificial Intelligence for services of the Ministry of Foreign Affairs (later merged into consular digital transformation law) | In Force | Limits to entities like the Ministry deciding processing in consular digital services context. |
| Rwanda | Law No. 058/2021 Relating to the Protection of Personal Data and Privacy | In Force | Adds primary responsibility including registration, breach notification, and data subject rights response. |
| Taiwan | Personal Data Protection Act (PDPA) | In Force (Amended) | Broadens to any agency or entity collecting, processing, or using data, bearing obligations for lawful collection and rights. |
| Thailand | Personal Data Protection Act B.E. 2562 (2019) | In Force | Specifies persons as natural or juristic with duties for lawful bases, safeguards, rights, and record-keeping. |
| Ethiopia | Personal Data Protection Proclamation No. 1321/2024 | In Force | Requires registration with the ECA and implementing safeguards. |
| Morocco | Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data | In Force | Plain definition focused solely on determining purposes and means with responsibility for law's obligations. |
| Ghana | Data Protection Act, 2012 (Act 843) | In Force | Plain and narrow, limits to person determining purposes and manner without mentioning means or responsibilities. |
| Panama | Law No. 81 of March 26, 2019 on Personal Data Protection | In Force | Plain definition including public authorities or agencies, alone or jointly determining purposes and means. |
What it triggers
- In Ecuador, controllers bear primary responsibility for ensuring processing complies with the law, implementing safeguards, enabling data subject rights, and demonstrating accountability.
- In Malaysia, controllers must appoint Data Protection Officers and fulfil governance, notification and record-keeping duties.
- In Rwanda, controllers bear primary responsibility for registration, breach notification, and responding to data subject rights.
- In Ethiopia, controllers are responsible for registration with the ECA and implementing required safeguards.
Definitions (21)
The natural or legal person, public authority, agency or other body that determines the purposes and means of processing personal data. Controllers bear primary responsibility for ensuring processing complies with the law, implementing safeguards, enabling data subject rights, and demonstrating accountability.
The statutory replacement for the prior term 'data user', referring to the person or entity that determines the purposes and means of processing personal data and bears primary accountability for compliance obligations under the Act. Controllers must appoint Data Protection Officers and fulfil governance, notification and record-keeping duties introduced or clarified by the Amendment.
The media house, publisher, or editorial entity that determines the purposes and means of processing personal data in news production and publishing, bearing primary responsibility for compliance with data protection obligations under this guide and the Data Protection Act.
An entity that determines the purposes and means of processing personal data and bears primary responsibility for ensuring processing complies with the Bill's principles and obligations, including accountability, security measures, and responding to data subject rights.
An entity that determines the purposes and means of processing personal data used in or by AI systems, bearing responsibility for ensuring compliance with applicable data protection obligations (including privacy impact assessments, lawful basis for processing and coordination with the Nigeria Data Protection Commission).
An entity (typically the Ministry or a cooperating public body) that decides on the purposes and means of processing personal data in the context of consular digital services and is thus responsible for complying with applicable data protection obligations and safeguards.
A natural or legal person who alone or jointly with others determines the purposes and means of processing personal data and who bears primary responsibility for ensuring that processing complies with the law, including obligations such as registration, breach notification, and responding to data subject rights.
A government agency or non-governmental entity that collects, processes, or uses personal data and thereby bears primary legal obligations under the PDPA to ensure lawful collection, purpose limitation, security, and fulfillment of data subject rights.
A person (natural or juristic) who alone or jointly with others determines the purposes and means of processing personal data; the controller bears primary legal responsibilities under the PDPA to ensure lawful bases, implement safeguards, respond to data subject rights, and comply with record‑keeping and other obligations.
The person or organization that alone or jointly with others determines the purposes and means of processing personal data under Law No. 6698; the Guide emphasizes controllers' responsibility for ensuring AI projects comply with data protection obligations, including lawful bases, DPIAs, and contractual allocation of roles with processors.
An entity that determines the purposes and means of personal data processing in relation to chatbot systems and therefore bears primary responsibility for compliance with Law No. 6698, including registration, transparency, security measures, and data-subject rights facilitation.
A person or entity that determines the purpose for which and the manner in which personal data is processed. Data controllers are required to register with the Data Protection Commission and are responsible for ensuring compliance with data protection principles, security measures, and legal obligations under Ghanaian law.
A role defined consistent with Ghana’s Data Protection Act and referenced by the Strategy: an individual or organisation that determines the purposes and means of processing personal data and bears primary responsibility for ensuring compliance with data protection obligations, including registration and lawful handling.
An entity that determines the purposes and means of processing personal data and is responsible for ensuring compliance with legal obligations under the Proclamation, including registration with the ECA and implementing required safeguards.
The natural or legal person who determines the purposes and the means of processing personal data and is responsible for ensuring compliance with the law's obligations regarding that processing.
A person or entity that determines the purposes and means of processing personal data and is primarily responsible for ensuring compliance with the Bill's obligations, including registration, record-keeping, and implementing appropriate safeguards.
An organization or body that determines the purposes and means of processing personal data in line with Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016); responsible for ensuring lawful collection, consent, retention, transfer and protection of personal data used in AI systems.
A person who, either alone or jointly with others, determines the purposes for which and the manner in which any personal data is processed.
The natural or legal person or public authority that determines the purposes and means of processing personal data.
The natural or legal person, public authority, or agency which, alone or jointly with others, determines the purposes and means of the processing of personal data.
The natural or legal person, public or private, who decides on the database and/or the processing of the data; in the context of this pilot the Bogotá Metropolitan Police and TransMilenio act as data controllers and are responsible for demonstrating compliance with data protection principles.
Not to be confused with
Data controller determines purposes and means of processing, while data processor only processes on behalf of the controller.
Questions and answers
What responsibilities do data controllers have under Ecuador's LOPDP?
Controllers bear primary responsibility for ensuring processing complies with the law, implementing safeguards, enabling data subject rights, and demonstrating accountability.
Does Malaysia's amended PDPA require data controllers to appoint DPOs?
Yes, controllers must appoint Data Protection Officers and fulfil governance, notification and record-keeping duties.
What obligations apply to data controllers in Ethiopia's data protection law?
Controllers must register with the ECA and implement required safeguards to ensure compliance.
Related Terms
Controller (Responsable)
Entity determining purposes and means of processing....
Controller (responsible party)
Entity determining purposes and means of processing....
controller (responsable de traitement)
Entity determining purposes and means of processing personal data....
Controller (Pengendali Data Pribadi)
Entity determining purposes and means of processing....
Data processor
Entity that processes personal data on behalf of a controller....