[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fn8iRIB7tDwSgFumcKaucL7Gq4H2MRujHXKIGGNXxUAQ":3},{"tableOfContents":4,"markDownContent":5,"htmlContent":6,"metaTitle":7,"metaDescription":8,"wordCount":9,"readTime":10,"title":7,"nbDownloads":11,"excerpt":12,"lang":13,"url":14,"intro":12,"featured":4,"state":15,"author":16,"authorId":17,"datePublication":21,"dateCreation":22,"dateUpdate":23,"mainCategory":24,"categories":44,"metaDatas":50,"imageUrl":12,"imageThumbUrls":51,"id":52},false,"The controller is one of the parties involved in a processing operation along with the [**processor**](https://www.dastra.eu/en/guide/processor/56351), the joint controller and the third party.\r\n \r\n## Definition :\r\n \r\n▶ The **data controller** is **the natural or legal person who decides on the purpose and means of the processing**.\r\n \r\nA data controller is therefore characterised by his autonomy in setting up and managing a processing operation. **It is the data controller who decides to create or delete the processing operation**. They must therefore ensure compliance with all the obligations imposed by law.\r\n \r\nThis is generally the **organisation**.\r\n \r\n**For example**, a local authority will be responsible for processing carried out in the context of public activities, for example, the civil status file. A **private company will be responsible for processing carried out for employee management**. As an employer, it decides to process personal data in order to recruit employees and run the business.\r\n \r\nResponsibility is attached to the entity behind the decision, the purpose of the [**data processing activity**](https://www.dastra.eu/en/guide/data-processing-activity/56354).\r\n \r\n▶ **Liability for processing is similar to liability in contract or tort**. Thus, the data controller is generally not the company director, who is merely the data controller's legal representative.\r\n \r\nFor example, Dastra employs staff. It has a human resources director and a CEO. Processing relating to human resources management will be the responsibility of Dastra, the company. The CEO and HR Director are staff attached to the controller and are not autonomous. Their decisions are taken for the sole purpose of fulfilling the company's corporate purpose.\r\n \r\n▶ **Responsibility may sometimes rest with a physical person**. This is the case in particular for the professions (lawyers, doctors) or Members of Parliament in respect of their parliamentary activity.\r\n \r\n## \"Are you a data controller?\" self-assessment\r\n \r\n▶ Here is a **list suggested by the European Data Protection Supervisor**  to easily determine who is responsible for processing. If the majority of answers are YES, then you are a data controller.\r\n\r\n| **List** | **yes** | **no** |\r\n| --- | --- | --- |\r\n| You have decided to process [**personal data**](https://www.dastra.eu/en/guide/personal-data/56315) or you are at the origin of the processing by another entity | | |\r\n| You have decided what the purpose or result of the processing operation should be. | | |\r\n| You have decided on the essential elements of the processing operation, i.e. what personal data is to be collected, from whom, for how long, who has access to it, who the recipients are, etc. | | |The data subjects of your processing operations will be informed of the purpose of the processing operation.\r\n| The data subjects of your processing operations are your employees.\r\n| You exercise professional judgement when processing personal data.\r\n| You have a direct link with the data subjects. | | |\r\n| You have autonomy and independence in the way you process personal data. | | | You have appointed a processor.\r\n| You have appointed a processor to carry out processing activities on your behalf, even if the entity chosen for this purpose implements specific technical and organisational means (non-essential elements). | | |","\u003Cp>The controller is one of the parties involved in a processing operation along with the \u003Ca href=\"https://www.dastra.eu/en/guide/processor/56351\">\u003Cstrong>processor\u003C/strong>\u003C/a>, the joint controller and the third party.\u003C/p>\r\n\u003Ch2 id=\"definition\">Definition :\u003C/h2>\r\n\u003Cp>▶ The \u003Cstrong>data controller\u003C/strong> is \u003Cstrong>the natural or legal person who decides on the purpose and means of the processing\u003C/strong>.\u003C/p>\r\n\u003Cp>A data controller is therefore characterised by his autonomy in setting up and managing a processing operation. \u003Cstrong>It is the data controller who decides to create or delete the processing operation\u003C/strong>. They must therefore ensure compliance with all the obligations imposed by law.\u003C/p>\r\n\u003Cp>This is generally the \u003Cstrong>organisation\u003C/strong>.\u003C/p>\r\n\u003Cp>\u003Cstrong>For example\u003C/strong>, a local authority will be responsible for processing carried out in the context of public activities, for example, the civil status file. A \u003Cstrong>private company will be responsible for processing carried out for employee management\u003C/strong>. As an employer, it decides to process personal data in order to recruit employees and run the business.\u003C/p>\r\n\u003Cp>Responsibility is attached to the entity behind the decision, the purpose of the \u003Ca href=\"https://www.dastra.eu/en/guide/data-processing-activity/56354\">\u003Cstrong>data processing activity\u003C/strong>\u003C/a>.\u003C/p>\r\n\u003Cp>▶ \u003Cstrong>Liability for processing is similar to liability in contract or tort\u003C/strong>. Thus, the data controller is generally not the company director, who is merely the data controller's legal representative.\u003C/p>\r\n\u003Cp>For example, Dastra employs staff. It has a human resources director and a CEO. Processing relating to human resources management will be the responsibility of Dastra, the company. The CEO and HR Director are staff attached to the controller and are not autonomous. Their decisions are taken for the sole purpose of fulfilling the company's corporate purpose.\u003C/p>\r\n\u003Cp>▶ \u003Cstrong>Responsibility may sometimes rest with a physical person\u003C/strong>. This is the case in particular for the professions (lawyers, doctors) or Members of Parliament in respect of their parliamentary activity.\u003C/p>\r\n\u003Ch2 id=\"are-you-a-data-controller-self-assessment\">\"Are you a data controller?\" self-assessment\u003C/h2>\r\n\u003Cp>▶ Here is a \u003Cstrong>list suggested by the European Data Protection Supervisor\u003C/strong>  to easily determine who is responsible for processing. If the majority of answers are YES, then you are a data controller.\u003C/p>\r\n\u003Ctable>\r\n\u003Cthead>\r\n\u003Ctr>\r\n\u003Cth>\u003Cstrong>List\u003C/strong>\u003C/th>\r\n\u003Cth>\u003Cstrong>yes\u003C/strong>\u003C/th>\r\n\u003Cth>\u003Cstrong>no\u003C/strong>\u003C/th>\r\n\u003Cth>\u003C/th>\r\n\u003C/tr>\r\n\u003C/thead>\r\n\u003Ctbody>\r\n\u003Ctr>\r\n\u003Ctd>You have decided to process \u003Ca href=\"https://www.dastra.eu/en/guide/personal-data/56315\">\u003Cstrong>personal data\u003C/strong>\u003C/a> or you are at the origin of the processing by another entity\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003C/tr>\r\n\u003Ctr>\r\n\u003Ctd>You have decided what the purpose or result of the processing operation should be.\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003C/tr>\r\n\u003Ctr>\r\n\u003Ctd>You have decided on the essential elements of the processing operation, i.e. what personal data is to be collected, from whom, for how long, who has access to it, who the recipients are, etc.\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003Ctd>The data subjects of your processing operations will be informed of the purpose of the processing operation.\u003C/td>\r\n\u003C/tr>\r\n\u003Ctr>\r\n\u003Ctd>The data subjects of your processing operations are your employees.\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003C/tr>\r\n\u003Ctr>\r\n\u003Ctd>You exercise professional judgement when processing personal data.\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003C/tr>\r\n\u003Ctr>\r\n\u003Ctd>You have a direct link with the data subjects.\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003C/tr>\r\n\u003Ctr>\r\n\u003Ctd>You have autonomy and independence in the way you process personal data.\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003Ctd>You have appointed a processor.\u003C/td>\r\n\u003C/tr>\r\n\u003Ctr>\r\n\u003Ctd>You have appointed a processor to carry out processing activities on your behalf, even if the entity chosen for this purpose implements specific technical and organisational means (non-essential elements).\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003Ctd>\u003C/td>\r\n\u003C/tr>\r\n\u003C/tbody>\r\n\u003C/table>\r\n","Data controller","The controller is one of the parties involved in a processing operation along with the processor, the joint controller and the third party.",505,3,0,null,"en","data-controller","Published",{"id":17,"displayName":18,"avatarUrl":19,"bio":12,"blogUrl":12,"color":12,"userId":17,"creationDate":20},38,"Paul-Emmanuel Bidault","https://static.dastra.eu/tenant-27/avatar/38/paul-emmanuel-bidault-150.jpg","2019-12-03T19:09:28","2024-01-08T07:41:41.576","2024-01-08T08:41:39.5975686","2026-03-10T10:40:58.8328062",{"id":25,"name":26,"description":27,"url":28,"color":29,"parentId":12,"count":12,"imageUrl":30,"parent":12,"order":11,"translations":31},21,"Glossary","Definition of every word used by Dastra","glossary","#643bb0","https://static.dastra.eu/tag/b308b9d3-37af-4e92-8354-ab8adec1740a/documentation-1000.png",[32,36,40],{"lang":33,"name":34,"description":35},"fr","Glossaire","La définition de tous les termes utilisés dans Dastra",{"lang":37,"name":38,"description":39},"es","Glosario","La definición de todos los términos utilizados en Dastra",{"lang":41,"name":42,"description":43},"de","Glossar","Die Definition aller in Dastra verwendeten Begriffe",[45],{"id":25,"name":26,"description":27,"url":28,"color":29,"parentId":12,"count":12,"imageUrl":30,"parent":12,"order":11,"translations":46},[47,48,49],{"lang":33,"name":34,"description":35},{"lang":37,"name":38,"description":39},{"lang":41,"name":42,"description":43},[],[],56383]