Introduction
Determine when your company acts as a controller and what accountability duties come with deciding the purposes of processing. Use this for role mapping in contracts and operations.
What it means
A controller determines why and how personal data is processed.
Controllers are responsible for lawful basis selection, transparency, and rights handling.
Joint controllership can exist when two parties jointly decide purposes and means.
Controller responsibilities remain even when processing is outsourced to vendors.
Why it matters
Regulators, customers, and automated scanners increasingly treat published policies and live site behavior as one system. Gaps between what you say and what your site does create enforcement and commercial risk.
Fixing issues early is cheaper than retrofitting consent, tag managers, and legal pages after a complaint or failed enterprise security review.
Common mistakes
- Calling yourself a processor while setting campaign targeting and retention rules.
- Using vague vendor contracts that do not reflect actual roles.
- Failing to document controller decisions for high-risk processing.
- Assuming processors handle all DSAR and breach obligations.
- Not assigning internal ownership for controller duties.
Practical checklist
- Map which party decides purpose and essential means per workflow.
- Document controller or joint-controller role per processing activity.
- Align privacy notice and lawful basis with controller decisions.
- Maintain records of processing and risk assessments.
- Define DSAR ownership and escalation paths internally.
- Review vendor agreements for role consistency.
How GDPRChecker helps
GDPRChecker helps teams turn legal theory into testable controls. Its scanner identifies trackers, third-party calls, and policy mismatches so you can prioritize the highest-risk gaps first.
After changes ship, GDPRChecker runtime monitoring can confirm consent and tag behavior remains aligned over time. That makes compliance less of a one-off audit and more of an operational process.