A data controller is the organisation that decides why personal data is processed and how. Under the General Data Protection Regulation (GDPR), that decision carries the law's heaviest burden: the controller must have a lawful basis, inform the people concerned, answer their rights requests, secure the data and prove all of it on demand. The concept exists so that someone is always answerable for a data flow, however many companies touch it along the way.

In advertising, an advertiser uploading a customer list, a publisher running a consent banner and a platform building interest profiles may each be a controller for a different slice of the same campaign.

Article 4(7) of the GDPR defines the controller as "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data". Two elements do the work. Purposes are the why: building audiences, measuring conversions, preventing fraud. Means are the how: which data, which systems, how long it is kept, who receives it.

The European Data Protection Board (EDPB), in Guidelines 07/2020 adopted in final form on July 7, 2021, refines the second element. It separates essential means, such as the categories of data collected, the retention period and the recipients, from non-essential means, such as the choice of software or security measures. A company can leave non-essential means to a vendor and still be the controller. Whoever fixes the purpose and the essential means holds the role.

The test is factual, not contractual. Article 28(10) makes the point directly: a processor that determines purposes and means "shall be considered to be a controller in respect of that processing". Control is also assessed operation by operation, so one company can be a controller for collection and a processor for storage.

What the role requires

Article 5(2) sets the principle of accountability: the controller is responsible for compliance with the core principles and must be able to demonstrate it. Article 24 turns that into a duty to implement "appropriate technical and organisational measures", scaled to the risk of the processing.

In practice the controller chooses a lawful basis under Article 6, provides notices under Articles 13 and 14, handles rights requests under Articles 15 to 22 and builds protection in by design under Article 25. It keeps records under Article 30, notifies breaches within 72 hours under Article 33 and runs impact assessments for high-risk processing under Article 35. When it hands work to a vendor, Article 28 obliges it to use only processors offering "sufficient guarantees" and to bind them by contract.

Penalties follow the duties. Breaches of the core principles or lawful basis rules sit in the upper tier of Article 83(5): up to 20 million euros or 4% of worldwide annual turnover, whichever is higher. National authorities issued 1,145,760,374 euros in GDPR fines during 2025, according to the EDPB's annual report of April 9, 2026.

How roles divide in an ad transaction

Platform terms usually allocate roles, and not all draw the line alike. Google states that it and Ad Manager publishers "operate as independent controllers of personal data", while acting as a processor for certain features. In enterprise software the default runs the other way. Under Microsoft's data protection addendum, the enterprise is the controller and Microsoft the processor, and a May 22, 2026 revision cut notice for new AI subprocessors to 30 days.

Regulators look past the paperwork. Poland's authority fined McDonald's Polska 16,932,657 zlotys, about 3.89 million euros, on July 21, 2025, treating it as controller of a staff scheduling system because it set purposes and methods, although the vendor alone held administrative access. France's CNIL went the other way with a vendor: it fined the marketing platform Optimove 1 million euros on December 11, 2025 for copying a client's user data for its own use.

Where two parties decide together, Article 26 makes them joint controllers. The Court of Justice of the European Union (CJEU) applied that to Facebook page administrators in Wirtschaftsakademie (C-210/16) on June 5, 2018, to websites embedding the Like button in Fashion ID (C-40/17) on July 29, 2019, and to IAB Europe's handling of the Transparency and Consent String in C-604/22 on March 7, 2024. Belgium's Market Court later confined IAB Europe's joint controllership to the TC String on May 14, 2025, leaving downstream bidding outside it.

Origin and evolution

The idea predates the GDPR by decades. The Council of Europe's Convention 108, opened for signature on January 28, 1981, assigned responsibility to the "controller of the file", a phrase built for mainframes. The 1995 Data Protection Directive (95/46/EC), adopted on October 24, 1995, dropped the file and defined the controller in Article 2(d) by the same purposes-and-means test the GDPR still uses.

The Article 29 Working Party, the EDPB's predecessor, adopted Opinion 1/2010 on February 16, 2010 to explain how controllers and processors should be told apart. On May 13, 2014, in Google Spain (C-131/12), the CJEU held that a search engine operator was the controller of its own indexing of third-party pages, widening the concept to intermediaries.

The GDPR, adopted on April 27, 2016 and applicable from May 25, 2018, kept the definition but added the accountability principle, made processors directly liable for the first time and wrote joint control into Article 26. The EDPB's 2021 guidelines replaced the 2010 opinion.

The latest shift concerns what counts as personal data in a controller's hands. In EDPS v SRB (C-413/23 P), decided on September 4, 2025, the CJEU held that pseudonymised data "must not be regarded as constituting, in all cases and for every person, personal data", according to a Future of Privacy Forum analysis. For the Single Resolution Board, which held the re-identification key, comments sent to Deloitte stayed personal data. For Deloitte, without the key, they might not have been. The board's duty to name Deloitte as a recipient was still judged from the controller's perspective, at collection.

Outside the EU

The UK kept the GDPR definition after Brexit in the UK GDPR. The Data (Use and Access) Act 2025, which received Royal Assent on June 19, 2025, left the controller concept unchanged but altered several controller duties, including a "stop the clock" rule from February 5, 2026 that pauses access-request deadlines while a controller waits for clarification.

US state law uses different words for a similar split. The California Consumer Privacy Act (CCPA), in force since January 1, 2020, regulates a business: a for-profit entity that determines the purposes and means of processing and meets one of three thresholds. Those are annual gross revenue above an inflation-adjusted figure, set at 26,625,000 dollars from January 1, 2025 according to the California Privacy Protection Agency, buying, selling or sharing the data of 100,000 or more consumers or households, or earning half its revenue from selling or sharing personal information. Its counterparts to processors are service providers and contractors. California's Attorney General reached a 1.55 million dollar settlement with Healthline under the law.

Why the label matters for marketers

Controller status decides who needs the consent, who must honour an objection, and who pays when a tag misbehaves. Product changes can move the boundary. Until June 15, 2026, Google Signals acted as a co-controller of advertising data collection for linked Analytics and Google Ads accounts. After that date only Consent Mode's ad_storage signal governs it, which leaves sites without a consent platform exposed.

Limits and disputes

Critics say the concept is now too broad to guide behaviour. Joint control rulings make a publisher answerable for collection it cannot inspect, and platform terms allocating roles are standard-form documents few customers can negotiate.

The relative view of personal data adds a second dispute. The European Commission's Digital Omnibus proposal of November 19, 2025 would have written it into Article 4(1), so that information is not personal data for an entity that cannot reasonably identify the person. The EDPB and the European Data Protection Supervisor urged lawmakers in February 2026 not to adopt that narrowing. For ad tech, a narrower definition could take some hashed or pseudonymised signals outside a recipient's duties altogether.

Not the same as

Data processor. A processor handles personal data on a controller's documented instructions under an Article 28 contract and sets no purposes of its own.

Joint controller. Joint controllers share the decision on purposes and means and must allocate duties under Article 26. Companies acting independently on the same data are separate controllers, not joint ones.

Data protection officer. The officer is a person or team inside or contracted by the controller who advises and monitors compliance. The officer carries no controller liability.

Data owner. A contract and governance term with no meaning in the GDPR. Controllers hold responsibilities, not ownership.

Recent developments

The Council of the EU agreed its Digital Omnibus negotiating mandate on October 21, 2026, keeping the current definition of personal data while adding a provision on pseudonymisation and identification, according to Lovguiden.

The question of which controllers can be fined is also before the CJEU. In case C-458/25, Advocate General Manuel Campos Sanchez-Bordona advised on September 10, 2026 that Belgium cannot shield a subsidised private school group from fines, after the regulator found the group was the controller for pupils' data. Google's removal of Signals as an ad data control on June 15, 2026 drew criticism from Krista Seiden, a former Google Analytics product manager, who described it as quietly removing one of the most important privacy controls advertisers had in Analytics. Google called the change a simplification of controls.

Timeline

  • January 28, 1981: Convention 108 opens for signature, assigning responsibility to the "controller of the file"
  • October 24, 1995: Data Protection Directive 95/46/EC adopted, with the purposes-and-means definition in Article 2(d)
  • February 16, 2010: Article 29 Working Party adopts Opinion 1/2010 on controllers and processors
  • May 13, 2014: CJEU rules in Google Spain (C-131/12) that a search engine operator is a controller
  • April 27, 2016: GDPR adopted
  • May 25, 2018: GDPR applies
  • June 5, 2018: CJEU rules in Wirtschaftsakademie (C-210/16) on joint control of Facebook pages
  • July 29, 2019: CJEU rules in Fashion ID (C-40/17) on embedded plug-ins
  • January 1, 2020: CCPA takes effect in California
  • July 7, 2021: EDPB adopts final Guidelines 07/2020 on controllers and processors
  • March 7, 2024: CJEU rules in IAB Europe (C-604/22) on the TC String
  • January 1, 2025: CCPA revenue threshold for a "business" rises to 26,625,000 dollars
  • May 14, 2025: Belgian Market Court confines IAB Europe's joint controllership to the TC String
  • June 19, 2025: UK Data (Use and Access) Act 2025 receives Royal Assent
  • July 21, 2025: Polish authority fines McDonald's Polska as controller of a scheduling system
  • September 4, 2025: CJEU rules in EDPS v SRB (C-413/23 P) on relative personal data
  • November 19, 2025: Commission proposes the Digital Omnibus
  • December 11, 2025: CNIL fines processor Optimove 1 million euros
  • February 5, 2026: UK "stop the clock" rule for access requests applies
  • April 9, 2026: EDPB annual report puts 2025 GDPR fines at 1.15 billion euros
  • May 22, 2026: Microsoft revises its data protection addendum for AI subprocessors
  • June 15, 2026: Google removes Signals as an advertising data control in Analytics
  • September 10, 2026: Advocate General delivers opinion in C-458/25
  • October 21, 2026: Council agrees Digital Omnibus mandate keeping the personal data definition

Summary

Who. Any organisation, public body or individual that decides why and how personal data is processed: advertisers, publishers, platforms, data brokers, measurement firms and their clients. Regulators, the EDPB and the CJEU decide where the line falls.

What. A legal role defined in Article 4(7) of the GDPR that carries primary responsibility for lawful basis, transparency, rights handling, security and accountability, and the duty to bind processors by contract.

When. The concept dates to Convention 108 in 1981 and the 1995 directive, took its current form when the GDPR applied on May 25, 2018, and is being reshaped by the September 2025 SRB ruling and the Digital Omnibus negotiations.

Where. Across the European Economic Area and in the UK GDPR, with a close analogue in the CCPA's "business" and similar terms in other US state privacy laws.

Why. Data flows involve many companies, and the law needs one answerable party for each purpose. In advertising, the label decides who must collect consent, who answers a rights request and who pays when a pixel or upload goes wrong.