What is the difference between a data controller and a data processor when it comes to keeping records?

The terms data controller and data processor describe two different roles in handling personal information. The distinction shapes who decides what happens to records, who must keep them, and who is held accountable when something goes wrong. While these labels are most closely associated with modern privacy frameworks, the underlying idea — separating the party that decides from the party that acts on those decisions — applies broadly to records management.

What Each Role Means

A data controller is the organization (or individual) that determines why and how personal data is collected and used. The controller sets the purpose, decides what categories of information to gather, chooses how long to keep it, and is ultimately answerable to the people whose data it holds.

A data processor acts on the controller’s behalf and on the controller’s instructions. A processor handles, stores, or transmits personal data but does not independently decide the purpose for which it is used. Common examples include cloud hosting, payroll services, or document-scanning vendors that work under contract.

Why It Matters for Recordkeeping

The two roles carry different recordkeeping responsibilities:

• Controllers typically own the retention decision. They define how long records are kept, when they are disposed of, and how data subjects’ rights (access, correction, deletion) are honored. The controller usually maintains the authoritative record of processing activities.
• Processors must keep records that demonstrate they handled data only as instructed — including security measures, access logs, and evidence of secure disposal or return when the engagement ends.

A single organization can be a controller for some records and a processor for others. Clarity about which role applies to a given dataset determines who is accountable for retention schedules, audit trails, and breach response.

Practical Takeaway

When mapping your records, identify the role you play for each category of personal data. Controllers should document their purposes, lawful basis, and retention rules; processors should document the instructions they follow and how they safeguard and eventually dispose of the data. Written agreements between the two parties should spell out these responsibilities so that recordkeeping obligations do not fall through the cracks.

For related guidance on protecting personal information, see the privacy and PII topic hub. A risk-based approach to identifying, managing, and disposing of personal data is central to frameworks such as the NIST Privacy Framework.