Are You a Data Controller or Processor? A Practical Guide for Organisations

When it comes to UK and EU data protection law, one of the first and most important first steps is to determine whether you are acting as a Data Controller, Data Processor, or even a Joint Controller. Getting this classification right is essential, because each role carries different legal requirements and responsibilities under the UK GDPR and EU GDPR. Controllers face more extensive obligations. Processors, meanwhile, must comply with strict contractual and security requirements set by the Controller and the law

But here’s the challenge: your role isn’t defined by what you call yourself. It is determined by the facts, how you actually handle and make decisions about Personal Data in practice.

Why It’s Not Always Clear-Cut

Whilst identification of the correct role is therefore fundamental to data processing, it is not always simple and clear. Many organisations find themselves in complex data relationships, sharing data, working with multiple platforms, outsourcing services, or collaborating with partners.

This is why correctly identifying your role isn’t always straightforward.

EDPB Guidance: Still Useful

Even though the UK is no longer part of the EU, the European Data Protection Board (EDPB) guidance on Controllers and Processors remains one of the most reliable and widely used resources for organisations assessing their role. The EDPB provides a detailed framework and flow‑chart to help guide your decision-making.

To make this easier, we’ve taken the EDPB’s flow-chart and made it into a simple, user‑friendly interactive tool, available below. With thanks and acknowledgment

to the EDBP.

Five things to consider before appointing an Outsourced Data Protection Officer

Finding the right Outsourced Data Protection Officer (DPO) can be challenging with so many providers available. In this guide, we share five essential tips to help you select a DPO service that meets your organisation’s needs.

Tip #1 - Check Their Experience

Experience is key to successful delivery of the service, and outsourcing the role is a way to get experienced hands for a fraction of the price of employing the same experienced role internally. Ensure you understand exactly who your Outsourced DPO, including how many years of data protection experience they have and their previous data protection roles.

Tip #2 - Ensure Availability

If you appoint an outsourced DPO, you want to be able to contact them when you need. Some providers only allow for assigned and allocated days to contact your DPO, whilst others allow you access as and when you need.

Tip #3 - Confirm Non-Restrictive Service

A DPO has statutory tasks they must undertake. You should understand whether for the quoted price the Outsourced DPO will complete these as required, or whether there are restrictions on their time, which could see you incur further costs.

Tip #4 - Look for a Personable Approach

Often outsourced services can feel 'distant' to the company and staff, despite paying a premium price. A personable DPO who integrates well with your team can make a big difference in communication and compliance culture.

Tip #5 - Verify Qualifications

There is no formal Data Protection Officer qualification approved by the UK regulator. So look out for qualifications such as Masters in Law (although there is absolutely no requirement for a DPO to be a lawyer), the BCS Data Protection Practitioner Certificate or CIPP/E.

Do your comparisons

There are many providers out there to choose from, all offering different levels and styles of service. Use this checklist to compare providers.

About Iniver

Iniver is a specialist data protection consultancy firm providing only 'Full-Service' DPO services, led by Joe Stock LLM, a data protection professional with 14 years experience.