Controller
A controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data (Art. 4(7) GDPR). The controller carries the primary obligations: lawfulness, transparency, data subject rights, security, accountability, breach notification and, where applicable, the DPIA and the appointment of a DPO and of an EU representative.
Controllership is a question of fact, not of contract: the EDPB Guidelines 07/2020 explain that whoever decides "why" and the essential "how" of processing is the controller, even if the contract says otherwise. Where two or more entities jointly determine purposes and means, they are joint controllers under Art. 26. A body processing only on instructions is a processor.
In clinical trials, the sponsor is controller for the trial dataset because it defines the protocol, and the site is controller for medical care and source documents. A CRO is normally a processor, unless it takes independent decisions on purposes. A HealthTech company offering an app to patients is controller for the app data, and becomes a processor when it deploys the same technology on behalf of a hospital. Getting this allocation right drives every downstream obligation and should be documented in a DPA or joint-controller arrangement.
