According to Article 4(7) of GDPR:
‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
What if the organization comes into possession of certain data, but never intended to acquire it, and therefore hasn't determined any purposes or means of processing them?
For example, a certain company ABC rents rooms to other companies and one day in one of the rooms (no longer rented by anyone) finds a box full of documents. There are personal data. Company XYZ, which used this room earlier, claims that this data does not belong to it and that it is not the controller. Does ABC temporarily become their controller in the sense of the GDPR and is therefore obliged to take certain actions as described in GDPR to protect this data? Or maybe ABC is not the controller and the protection of these found data results from completely different legal acts?