Definition
Under the GDPR and UK GDPR, a data controller is a natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of processing personal data. In plain language, the controller decides what the data is for and the main rules for using it.
The controller does not have to store the data or operate the technology directly. An organization can appoint a data processor to handle data on its behalf, but the controller remains responsible for deciding the purpose of the processing and for choosing and overseeing suitable processors.
The same organization can be a controller for one activity and a processor for another. For example, an analytics customer may control visitor-data processing for its own website, while an analytics provider processes that data under the customer’s documented instructions. Where two organizations jointly decide the purposes and essential means, they may be joint controllers.
What does that mean
Think of the controller as the decision-maker for personal data: it chooses the reason for using the data and the main rules for doing so. A processor may do the practical work, but it follows the controller’s instructions.
Why this matters
Knowing who the controller is makes accountability clearer. Data and IT teams can define purposes, access, retention, privacy safeguards, and vendor instructions; product teams can use behavioral insight without treating the analytics provider as the party that decides why customer data is collected.
Use cases
Setting accountability for digital analytics
A company wants to understand how visitors use its website or app, but several teams and tools are involved in collecting and analyzing the data.
The organization identifies itself as the controller, defines the analytics purpose and permitted data, documents its legal and privacy requirements, and sets rules for access, retention, and minimization before implementation.
Teams know who owns the decisions and can create a clearer, more defensible data-governance process instead of leaving privacy choices to a tool’s default settings.
Choosing and governing analytics vendors
An organization plans to use an external analytics or customer-experience platform that will process personal data on its behalf.
The controller distinguishes its own decisions from the vendor’s processing work, reviews the data processing agreement and subprocessors, provides documented instructions, and checks that the vendor can support security and data-subject obligations.
Roles, escalation paths, and contractual expectations are clearer, which can make privacy reviews and responses to data-subject requests more consistent.
Balancing insight with data minimization
A product or UX team needs behavioral evidence to diagnose friction, but session recordings or event data could reveal more personal information than the analysis requires.
The controller defines the minimum data needed for the use case and configures safeguards such as masking, redaction, restricted access, and retention limits. The team then validates that the captured data matches the stated purpose.
The organization can learn from real customer behavior while reducing unnecessary exposure and making its analytics practice easier to explain to customers and internal reviewers.
How Contentsquare helps
Contentsquare’s Data Processing Agreement sets out that the customer is the controller for personal data processed to provide the CS Service, while Contentsquare acts as processor under documented instructions; it also describes circumstances in which Contentsquare may act as a controller.
Data masking controls help teams manage what visitor personal data looks like in the Contentsquare platform, including automatic redaction and configurable element-masking rules.
Session Replay helps teams inspect what users experienced when diagnosing friction; controllers can pair that analysis with appropriate capture, masking, access, and retention decisions.
Smart Capture automatically captures interactions from day one, so controllers and implementation teams should define the permitted data and privacy rules before relying on the resulting dataset.
Data Connect lets teams select datasets to sync into a data warehouse, supporting a more deliberate approach to where analytics data is made available and how it is governed downstream.
Data Subject Request Portal provides a route for customers to submit relevant requests to Contentsquare when the platform is acting as their processor, supporting the controller’s response process.
FAQs on data controllers
A data controller is the person or organization that decides why personal data is processed and the main ways it will be processed. Under the GDPR and UK GDPR, that can include deciding what data to collect, how long to keep it, who can access it, and which service providers may process it.