Under the General Data Protection Regulation (GDPR), the term “data controller” refers to any person or legal entity that determines how and why personal data is processed. In order to be fully compliant with GDPR, it is essential to provide clear identifying details of the data controller in your privacy policy.
What is a Data Controller?
A data controller is anyone who decides how and why personal data will be processed. This could be an individual, a company, or another type of organization.
Data Controller vs Data Processor
- Data Controller: The entity that determines the purpose and method of data processing.
- Data Processor: The entity that processes personal data on behalf of the data controller, but not for its own purposes.
💡 Example:
If an online store collects customer information on its website and stores it on a third-party cloud service, the online store is the data controller, and the cloud service is the data processor.
Why is it necessary to include identifying details?
Under GDPR, it’s mandatory to disclose the identifying details of the data controller within your privacy policy.
For a legal entity (like a company), this would typically include the name of the organization, its registered office, and contact details, such as:
Example:Complianz Ltd. – 123 Example Street, City, Country[email protected]
For individuals (such as freelancers), even though it’s not always required to provide their full address, it is important to offer sufficient identifying information that ensures unequivocal identification.
💡 Example for a Freelancer Data Controller:
If the data controller is a freelance consultant, the privacy policy might include:John Doe, Consultant – 456 Freelancer Road, City, Country[email protected]
This ensures that users can easily identify the data controller and know how to get in touch with them if they have any questions or concerns regarding their data.
Do you have to provide the full address if the data controller is an individual?
If the data controller is a natural person (for example, a freelancer), you still need to provide enough details for clear identification. While GDPR doesn’t always require the full address in such cases, we recommend that individuals still include personal and contact details to avoid any ambiguity.
However, in certain situations, specific exemptions may apply where full address disclosure might not be mandatory, as long as other information ensures clear identification.
