Data controller vs data processor: Two roles defined in data protection law: the controller determines the purposes and means of processing personal data; the processor processes it on the controller's behalf and under its instructions.
Also known as: Controller and processor, Responsable y encargado del tratamiento
Key takeaways
- The controller decides the why and the how; the processor follows instructions.
- Roles are decided by facts, not labels: whoever actually sets the purpose is a controller.
- One provider can be a processor for some data and a controller for other data, such as its own account records.
- GDPR requires a written agreement between controller and processor covering specific terms.
- Check C Chat's privacy policy and terms, and confirm role allocation with your counsel.
Data protection law does not ask “who owns the data?” It asks “who decides what happens to it?” That question splits organizations into two roles, controller and processor, and it determines who answers to regulators, who signs which contract and who responds when an employee asks for their data.
A data controller vs a data processor: a plain definition
| Controller | Processor | |
|---|---|---|
| Decides | Why data is processed and the essential means | Technical details, within the controller’s instructions |
| Typical example | An employer using a chat app for operations | A provider hosting messages for that employer |
| Main duties | Lawful basis, transparency, individuals’ rights, overall accountability | Security, confidentiality, following instructions, helping the controller |
| Contract | Must have a written agreement with its processors | Must not process data for its own purposes outside the agreement |
The terms come from GDPR, but similar ideas appear in many data protection laws in Latin America and elsewhere.
How it works
Roles are assigned by looking at what each party actually does. A few practical tests help:
- Who chose to collect this data, and for what? That party is usually a controller.
- Who could stop processing tomorrow? The controller can; the processor must follow.
- Who uses the data for its own goals? If a provider uses data for its own purposes, it is a controller for that use.
One provider often wears both hats. It may be a processor for the content a customer’s team posts, and a controller for its own account, security and anti-abuse records. That is normal and should be reflected in its privacy documentation.
Why it matters for business messaging
The roles decide who does what when real situations arise:
- An employee asks for a copy of their data. The controller must respond; the processor helps.
- A manager wants to review group chats. The controller must have a lawful basis and tell staff in advance. See the guide on GDPR considerations for workplace messaging.
- Records must be kept for a dispute. The controller issues a legal hold; the processor’s tools determine how preservation works in practice.
- Data must stay in a region. The controller needs facts about data residency from the processor.
- Retention decisions. The controller sets the retention policy; the tool’s features determine how it is applied.
How it relates to C Chat
When your company creates a team in C Chat and decides who joins which groups, your company makes key decisions about that work data. C Chat’s design reflects that split:
- Your team’s group conversations can be audited and exported by your team owners and admins, which supports your duties as the party responsible for those records.
- Direct messages between people are private and are not part of your team’s audit or export.
- Platform access to content happens only for moderation of reported messages or legal requirements, and it is logged.
- Account and security data, such as sign-up by phone or email, is handled by C Chat, operated by CGuard Pro LLC (Texas, USA).
For security companies using CGuard Pro, the security company can audit site groups and security-related chats between guards and the office, which matters when deciding roles between the security company and its clients.
The compliance overview, data retention in C Chat, the privacy policy and the terms describe how C Chat handles data today. For contract questions, email support@cguardpro.com.
Related terms and common misconceptions
- “The vendor stores it, so the vendor is responsible.” Storage alone does not make a party the controller.
- “A processor has no obligations.” Processors have direct duties, including security and confidentiality.
- “Roles are whatever the contract says.” Contracts matter, but regulators look at what actually happens.
When comparing vendors, the vendor security questionnaire includes questions about roles, subprocessors and exports. The guides on legal hold and eDiscovery and exporting chats for compliance show how controller duties play out in chat.
Getting started
Map your messaging data first: which groups your company runs, who administers them and what is reviewable. Then set up that structure in C Chat by creating a team in the web app at getcchat.com/c and assigning owners and admins.
Frequently asked questions
Who is the controller when a company uses a chat app for work?
Typically the company that decides to use the app for its operations, defines who joins which groups and decides whether group conversations are audited. The exact allocation depends on the facts and the contract, so confirm it with your counsel.
Can a company be both a controller and a processor?
Yes. A provider can act as a processor for customer content it handles on instructions, and as a controller for data it uses for its own purposes, such as managing user accounts, billing or preventing abuse.
What is a data processing agreement (DPA)?
It is the contract GDPR requires between a controller and a processor. It sets out the subject and duration of processing, the type of data, security measures, use of subprocessors and how the processor helps the controller meet its obligations.
Are joint controllers possible?
Yes. When two organizations jointly decide the purposes and means of processing, they are joint controllers and must agree how they share responsibilities, for example who answers individuals' requests.
What is a subprocessor?
A subprocessor is another provider that a processor engages to help process the controller's data, such as a hosting or SMS delivery service. Controllers usually expect to be informed of subprocessors and to have a way to object.