In our company training on Data Protection this statement is made

A data controller is the person (legal or natural) who decides on the purpose for which data is to be collected, held or processed. is the data controller for all the personal data held by us.

Is it correct that the "entire company" by name can be the Data Controller?


1 Answer 1



Under the Data Protection Act in the United Kingdom, data subjects are individuals whose data is collected and data controllers are those upon which duties are placed to decide how and why that data is processed. "A data controller means ... a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed." A data controller must be a "person" under the law, meaning it could be an individual, an organization, and other corporate and unincorporated bodies of persons. They are usually organizations, though.

Even if a person is given the responsibility within an organization, that person will be acting on behalf of the organization, so the organization will be the data controller. The data controller "must ensure that any processing of personal data for which they are responsible complies with the Act." As such, a data processor "in relation to personal data, means any person (other than an employee of the data controller) who processes the data on behalf of the data controller."

Go here for a comprehensive explanation of the difference between data controllers and data processors and what the governance implications are for each: https://ico.org.uk/media/for-organisations/documents/1546/data-controllers-and-data-processors-dp-guidance.pdf.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .