What is a Data Controller?

As per the DSCI Privacy Framework and consistent with definitions in APEC and GDPR standards, a Data Controller (or Personal Information Controller) is defined as:

“A person or organization who controls the collection, holding, processing, or use of personal information. It includes one who instructs another to do so on its behalf.”

Thus, a data controller determines the “purpose and means” of processing, not merely performing or facilitating storage or sharing.

This is a central concept to ensuring accountability in privacy frameworks, as the controller is the primary entity responsible for compliance with data protection principles.

==============