In a company, the data controller will be tasked with:

Collect the personal information of its customers, and website users, and must have the legal authority to do so.

Deciding where and how to use the data and for what purpose.

Keeping the data internally or sharing it with third parties. Also deciding with whom to share the data.

Establishing how long the data is kept and when to dispose of it.

A data processor is one who carries out the actual processing of data under the specific instructions of the data controller.

It is the one to whom the data controller instructs or assigns the task of doing, for example, any of the following:

Design, create and implement processes and systems that enable the data controller to collect personal data.

Use tools and strategies to collect personal data.

Implement security measures to safeguard personal data.

Transferring data to another organization and vice versa.

And when comparing GDPR processor vs. controller?

Quickly and comparatively, GDPR controllers vs processors, two have different roles and responsibilities.

For some companies, the distinction might not be as clear as in the explanation above.

Whereas with the gdpr data controller we mean the natural or legal person, public or private, who decides on aspects of the processing of personal data such as the purpose and use of the data or the retention periods.

By the gdpr data processor, we mean the service provider who, whether internal to the company or contracted by the data controller (in an external company), must access the personal data for processing and which is the responsibility of the data controller. In fact, simply accessing or viewing the data already implies “processing” as, for example, in the case of suppliers providing maintenance or IT support services. Although they do not have to handle personal data for the provision of the service, they are considered as gdpr data processors.

Let’s say we are a tourism website and we ask for data such as email addresses from users who register. Once they give us their data, we collect it, classify it and assign a purpose, storage, and processing; we decide to send a newsletter. Here we have moved from analyzing the data to processing it. From how to use them to execute the decision. From the data controller to the data processor. And as a final bonus, the “data controller” is responsible for ensuring that “data processors” have measures in place to comply with the GDPR. In addition, the “data controller” has the responsibility to demonstrate compliance with the GDPR.

This is how a security cycle is established in the processing, storage, and use of our data in any company within the GDPR umbrella.

The main tasks of a data controller include:

Determining the purposes for which personal data is collected, processed, and used.
Ensuring that personal data is collected, processed, and used in compliance with data protection laws and regulations.
Providing clear and concise information to data subjects about how their personal data is being used and processed.
Ensuring that the rights of data subjects are respected and protected, such as the right to access, rectify, and erase personal data.

The main tasks of a data processor include:

Processing personal data on behalf of the data controller and only for the purposes specified by the data controller.
Implementing appropriate technical and organizational measures to protect personal data from unauthorized access, destruction, or disclosure.
Maintaining accurate and up-to-date records of data processing activities.
Cooperating with the data controller to ensure compliance with data protection laws and regulations.