Data Controller

Definitions #

The person or organization that decides why and how personal data is processed, under data protection law.

Technical Under GDPR and similar laws, the natural or legal person that determines the purposes and means of processing personal data, bearing primary compliance responsibility.

Example The hospital acts as a data controller when it collects patient records to provide medical care.

Etymology #

From EU data protection law, specifically the 1995 Directive 95/46/EC and reinforced in GDPR (2016/679), where 'controller' replaced the earlier term 'data user'.

Collocations #

data controller vs processor 控制者决定处理目的与方式，处理者按指示处理
joint controllers 两个以上主体共同决定目的与方式，需安排责任分配
controller’s obligations 控制者的义务，包括数据保护影响评估（DPIA）和记录活动

Real Business Examples #

The SaaS vendor is a data processor, while the client remains the data controller under the DPA.
As a data controller, the logistics firm must implement appropriate technical measures to secure shipment data.

Register & Variants #

Register: formal
BrE/AmE: 全球通用，GDPR 及其他隐私法领域

Synonyms & Antonyms #

Synonyms: data user (older UK term)
Antonyms: data subject, data processor

Common Errors #

将数据控制者与处理者的角色等同，认为有合同就能转嫁全部责任控制者对处理者行为负最终责任，即使委托处理，监管机关仍追究控制者；需明确合同中的责任条款
误以为只有拥有数据的人才是控制者控制者是决定处理目的与方式的人，不一定是数据保管方；例如云计算客户是控制者，云服务商是处理者

Confusable Terms #

Data processor vs Data Controller: 处理者按控制者指示处理数据，没有独立决定权
Data subject vs Data Controller: 数据主体是信息被处理的个人，而不是决策者

Frequently Asked Questions

如何判断自己是控制者还是处理者？?

关键看谁决定处理目的与方式；若你决定收集什么数据、为何收集，你就是控制者；若你仅为他人指示处理，就是处理者

两个公司联合决定处理时怎么办？?

构成 joint controllers，需在合同或安排中明确各自责任和透明度义务，但仍对外共同负责

Published: 2026-09-22 Category: Data Protection