AI Governance Engineer
GitHub

Controller and processor

By Updated

Under the GDPR the controller decides the purposes and means of processing and carries most duties; the processor acts on its documented instructions 1. An AI vendor serving your inference is usually a processor, but becomes a controller for any use of your data it decides on, such as training.

Developed in
ch. 19, Controller, processor or joint controller
Chapters
ch. 19, Privacy & AI
Contrast with
Sub-processor
Source
1 numbered reference, listed below

Where it is used

The term is not used under this name in running prose; the sections listed under "Developed in" treat it.

Sources

  1. [1] Regulation (EU) 2016/679 (General Data Protection Regulation) (Arts. 4(1), 4(5), 4(7), 4(8), 4(12), 4(14), 5, 6, 9, 12(3), 22, 25, 28(2) and 28(4), 30, 33, 35; Recital 26). Publications Office of the EU (EUR-Lex). 2016-04-27. https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng (verified: primary)

Definitions of legal terms paraphrase the cited text, which governs. Dated statements are as of .

Cite this term

García Aibar, J. (2026). Controller and processor. In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), Glossary. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/glossary/controller-and-processor. CC BY 4.0

BibTeX

@misc{aige2026controllerandprocessor,
  author  = {Jorge García Aibar},
  title   = {{Controller and processor}},
  note    = {Glossary, AI Governance Engineering: The Thesis \& Body of Knowledge, version 0.5.0},
  year    = {2026},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/glossary/controller-and-processor}
}