Controllers

Legal Framework

The controller concept is defined in Article 4(7) GDPR, which establishes that a controller is the entity that—alone or jointly with others—determines the purposes and means of processing personal data. This definition is foundational: it triggers the full suite of controller obligations under the GDPR, including accountability under Article 24, transparency duties under Article 12, and the information requirements in Articles 13 and 14.

The Court of Justice confirmed the definitional scope in Schrems II, quoting the GDPR's own language:

"een natuurlijke persoon of rechtspersoon, een overheidsinstantie, een dienst of een ander orgaan die/dat, alleen of samen met anderen, het doel van en de middelen voor de verwerking van persoonsgegevens vaststelt"
— Schrems II ¶10

The definition expressly accommodates joint controllership—where multiple entities together determine purposes and means. Once controller status is established, the entity must comply with transparency obligations: Article 13(1) requires providing identity and contact details at the time data are collected from the subject, while Article 14(1) imposes equivalent duties when data are obtained indirectly. Article 12 frames the manner of delivery:

"The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14"
— GDPR Art. 12(1)

Key Developments

Enforcement authorities have applied controller obligations with increasing rigour, particularly around documentation and information duties. The Danish DPA's action against IDdesign illustrates that controllers face sanctions not only for substantive violations but also for failure to maintain internal accountability records:

"the controller had not adequately documented its personal data deletion procedures"
— IDdesign, Danish DPA

The Polish DPA (UODO) pursued a company processing publicly sourced data for failing to meet Article 14 information obligations, finding that publishing a privacy notice solely on a website was insufficient when data subjects had no direct relationship with the controller. Although a court subsequently annulled the fine on procedural grounds—specifically, the authority's failure to substantiate the number of records affected—the substantive principle survived: controllers obtaining data indirectly must actively reach data subjects, not passively post information online.

The Deutsche Wohnen case further demonstrates that controller liability requires culpability under national law, a question the CJEU addressed in December 2023. The ruling confirmed that while culpability is necessary for fines against legal persons, the GDPR does not preclude member states from establishing attribution mechanisms.

Status of the Debate

The core definition of "controller" under Article 4(7) is settled, but its application to complex data-sharing ecosystems remains actively contested. Courts and DPAs continue to grapple with distinguishing controllers from processors in multi-party arrangements, and with identifying joint controllership in collaborative relationships. The Deutsche Wohnen referral to the CJEU on culpability requirements signals that the intersection of GDPR controller liability and national procedural law is still being defined. What would resolve the open questions is further CJEU guidance on the functional test for controller status—particularly whether influence over purposes and means must be substantive or merely formal—and clearer doctrinal boundaries for joint controllership under Article 26.

Practical Guidance

• Map your role functionally, not contractually. Controller status turns on who determines purposes and means, not on labels in a contract. Conduct a factual assessment of decision-making authority over each processing activity, referencing Article 4(7).
• Document accountability measures proactively. As the IDdesign enforcement shows, failure to maintain deletion policies and internal documentation is itself a violation. Establish written procedures for retention, deletion, and data subject rights handling.
• Fulfill information obligations actively. When processing data obtained indirectly, do not rely on website-only notices. Article 14(1) requires proactive communication to data subjects; the UODO enforcement confirms passive disclosure is insufficient.
• Clarify joint controllership arrangements. Where multiple entities jointly determine purposes and means, execute an Article 26 agreement allocating responsibilities transparently, and ensure data subjects can identify and contact each controller.
• Prepare for breach response as a controller duty. EDPB guidance emphasises that controllers must have incident response plans enabling prompt detection, risk assessment, and notification to supervisory authorities where required.