Learning 1 – Understanding UK Data Protection Law
1. Section 1: Understanding UK data protection law
1.3. 1.3 Controllers, processors and processing
1.3 Controllers, processors and processing
Who is responsible for decisions about personal data?
What is processing?
Processing is a very broad term. It includes collecting, recording, organising, structuring, storing, changing, retrieving, viewing, sharing, combining, restricting, erasing and destroying personal data.
The main roles
| Role | Meaning | Example |
|---|---|---|
| Data subject | The living person the personal data relates to. | A learner, customer, applicant or employee. |
| Controller | Decides the purposes and essential means of the processing. | A college deciding why it keeps learner records and how long it retains them. |
| Processor | Processes personal data on behalf of a controller under instructions. | A cloud payroll supplier operating the system for an employer. |
Joint controllers
Two or more organisations may be joint controllers where they jointly decide purposes and means. They should transparently allocate responsibilities, while each remains responsible for compliance.
Knowledge checkpoint
Answer each question before opening the suggested answer.
1. A company decides why customer records are collected and chooses the system fields. What is its likely role?
Suggested answer: Controller, because it determines the purpose and essential means.
2. A supplier stores the records only on the company's documented instructions. What is its likely role?
Suggested answer: Processor, subject to the actual facts and contract.
3. Does simply opening or viewing a record count as processing?
Suggested answer: Yes. Retrieval and consultation are forms of processing.
Official reference points
Legal accuracy: reviewed against official UK sources on 14 July 2026. This learning content is educational and is not a substitute for case-specific legal advice.