Data Controller

A data controller is any natural or legal person, authority, agency, or body that, alone or jointly, determines the purposes and means of processing personal data. Under GDPR, controllers bear the primary legal responsibility for compliance.

As a SaaS or e-commerce business collecting user data, you are almost always a data controller. This means you are responsible for ensuring your data practices comply with GDPR, obtaining valid consent, honoring data subject rights, and signing DPAs with your processors.

Joint controllers — where two or more entities jointly determine the purposes of processing — must establish a transparent arrangement defining their respective responsibilities.