The term controller refers to the entity that determines the “purposes and means” of how personal data will be processed.¹ Determining the “means” of processing refers to deciding “how” information will be processed.² That does not mean, however, that a controller will make every decision with respect to the processing of information.

The European Data Protection Board (EDPB) distinguishes between “essential means” and “non-essential means.”³ Essential means refers to those processing decisions that are closely linked to the purpose and the scope of processing and, therefore, considered by the EDPB to be “traditionally and inherently reserved to the controller.”⁴ In other words, these are decisions regarding how personal data will be processed that a controller should not delegate to a third party. The EDPB has taken the position that one of the essential means of processing is “the type of personal data” that will be processed.⁵ As a result, normally a processor should not determine the type of personal data that will be processed, and a processor that engages in such activity may be labeled as a controller by supervisory authorities.

¹ GDPR, Article 4(7).

² EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 1, adopted 2 Sept. 2020, at ¶ 33.

³ EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 1, adopted 2 Sept. 2020, at ¶ 38.

⁴ EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 1, adopted 2 Sept. 2020, at ¶ 38.

⁵ EDPB, Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 1, adopted 2 Sept. 2020, at ¶ 38.