Skip to main content
Glossary termPublished inNormenkader IBP

Controller

Also known as verwerkingsverantwoordelijke, data controller

What does "controller" mean under the GDPR?

‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

Defined in / by

Last updated: 14 October 2026.

The one who decides why and how

Two questions identify the controller: who decided the purpose of the processing, and who decided its essential means. The organisation that answers both is the controller, whatever a contract calls it. A software supplier that runs a pupil administration system for a school does not become controller by hosting the data, and a school does not stop being controller by outsourcing the hosting.

Most GDPR duties land on the controller. Article 5(2) makes it accountable for the principles. Article 24 requires it to implement appropriate measures and to be able to demonstrate them. Article 28 makes it choose processors that give sufficient guarantees, and Article 33 makes it notify a personal data breach to the supervisory authority.

In Dutch education the controller for a school's own records is in practice the school board, the bevoegd gezag, because the board decides what the school records about pupils and staff and through which systems. The Normenkader IBP puts final responsibility for information security and privacy with the same board. The definition also allows for joint control: where two parties decide purposes and means together, Article 26 treats them as joint controllers.

Questions and answers

Can a school board outsource its role as controller under the GDPR?

No. A school board can outsource processing to a processor, but the role of controller follows from who decides the purposes and means of the processing. A contract cannot move it to a supplier that only acts on the board's instructions, and the board stays accountable under Article 5(2) of the GDPR.

Can there be more than one controller for the same processing?

Yes. Article 4, point (7), of the GDPR speaks of a body that decides "alone or jointly with others". When two or more controllers jointly determine purposes and means, Article 26 makes them joint controllers who must set out their respective responsibilities in an arrangement.

Regulations

  • Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)

    The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.

    Next
    Every board knows its position against the Normenkader through a self-evaluation, and has a plan to meet all norms