Data Controller

What is a data controller?

A data controller is the company that decides why and how personal data is used. Under GDPR Article 4(7), it can decide "alone or jointly with others."

For your users and customer contacts, you are usually the controller. Your vendors are usually data processors: they handle the data on your instructions. For the full contrast, see controller vs processor.

Why it matters to you

The controller carries the main duties. Article 24 says you must put measures in place and be able to show you comply. Article 28 says you may only use processors that give sufficient guarantees, under a contract.

So when a vendor changes how it uses your data, the question lands on you. Watch for vendors that start using your data for their own purposes. At that point they may be acting as a controller of their own.

What to check

• Whether the vendor's DPA calls you the controller and itself the processor.
• Any purposes where the vendor says it acts as a controller, such as billing, security or product improvement.
• Which legal basis you rely on for each use of personal data.

Joint Controller

Read the full page on Joint Controller

Two companies are joint controllers when they decide together why and how personal data is used. Article 26 requires them to agree, in a transparent arrangement, who handles which duties, such as answering people's requests.

This can come up with analytics and ad tools. If you place a vendor's tracking code on your site and the vendor also uses the data for its own ads, you may share decisions about that data.

The arrangement does not limit people's rights. Under Article 26(3), a person can enforce their rights against each joint controller. Look for a joint controller addendum in the vendor's terms when you use its ad or analytics features. If there is none, ask how the vendor splits duties such as privacy notices and requests.

Lawful Basis and Legitimate Interest

Read the full page on Lawful Basis and Legitimate Interest

Under the GDPR, a controller needs a legal reason, called a lawful basis, for every use of personal data. Article 6(1) lists six: consent, contract, legal obligation, vital interests, public task and legitimate interests.

Legitimate interest is the flexible one. It allows use that serves a real business interest, unless the person's interests or rights override it. That balancing test is part of the rule.

A vendor's privacy policy may name legitimate interest for its own uses, such as security, analytics or product improvement. Read those passages closely. When a vendor relies on it to use your users' data for new purposes, such as AI features, ask whether it acts for you or for itself. If it acts for itself, your DPA may not cover that use, and your own privacy notice may need to mention it.

How Venpo helps

Venpo monitors your vendors' privacy policies and DPAs and emails you when a vendor changes its role, its purposes or the legal basis it names. Each alert explains what changed and why it matters to you as the controller.