Data controller vs data processor

GDPR Article 4 defines the two roles. The controller is the person or organisation that determines the purposes and means of processing personal data, alone or jointly with others. The processor processes personal data on behalf of the controller.

The roles carry different duties. The controller is responsible for having a lawful basis, informing people, and handling their rights requests. A processor may act only on the controller's documented instructions, and Article 28 requires a contract (often called a data processing agreement, or DPA) covering subject matter, duration, security, sub-processors, assistance with rights requests and deletion or return of data at the end. One company can be a processor for some data and a controller for other data.

Which role applies depends on the facts, not just the contract wording. This is general information, not legal advice.

When a sales team uploads prospect lists to a verification, enrichment or sending tool, it usually remains the controller of that contact data and the tool acts as its processor. That means your team still owns the lawful-basis decision, the privacy notice and objections, and needs a DPA with the tools it uses.

For contact data customers submit to Skrap.ai (for example lists to verify or names to find), the customer is the data controller and Skrap processes it on the customer's instructions. Settings offers self-serve data export (JSON) and account deletion, and the team-wide do-not-contact list helps you act on objections. Details are on GDPR and data protection.