Glossary
Controller
The person or body that, alone or jointly with others, determines the purposes and means of processing personal data (GDPR Article 4(7)).
Article 4(7) GDPR defines the controller as the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where two or more controllers jointly determine purposes and means, they are joint controllers under Article 26. EDPB Guidelines 07/2020 explain that the controller decides the purposes and the "essential means" of processing, while a processor may decide non-essential means such as the choice of hardware or software.
The controller carries primary responsibility under the accountability principle in Article 5(2): it must comply with the GDPR and be able to demonstrate compliance. Article 24 requires it to implement appropriate technical and organisational measures, and it is the controller that notifies breaches under Articles 33 and 34.
For security and IT teams, knowing who the controller is determines who takes decisions during an incident, who signs processor contracts, and whose risk assessment governs security measures. Your organisation is usually the controller for its own HR, customer and security monitoring data. See our guide to processor contracts under Article 28 for how the roles are split in practice.