Data controller vs data processor: what is the difference for data licensing?

The short answer: whoever decides the purpose is the controller

Under the EU's General Data Protection Regulation, a controller is the person or organization that, alone or jointly with others, determines the purposes and means of processing personal data. A processor processes personal data on the controller's behalf. Article 28 requires a processor to act only on the controller's documented instructions, and Article 28(10) adds that a processor which starts determining purposes and means itself is treated as a controller for that processing.

The same company is often both. A payroll provider is the controller of its own staff files and its sales CRM, and a processor of the employee data its clients send it. The question is always asked per dataset, never per company.

For a company weighing whether to license records to AI labs and data buyers, the line is decisive. Records it controls may be candidates, subject to its notices, contracts and policies. Records it holds as a processor for clients are generally the clients' to decide about, and using them for the company's own licensing deal would turn it into a controller without the right to be one.

Controller vs processor, side by side

The CCPA version: business vs service provider

California uses different words for a similar split. The CCPA applies to for-profit businesses doing business in California that meet any one of three thresholds, which the California Attorney General's CCPA overview lists. Under section 1798.100 of the CCPA statute, a business that discloses personal information to a service provider or contractor must have a written agreement limiting its use to specified purposes. In practice a service provider sits where a GDPR processor sits: it may use the information for the business purposes the contract names, not sell or share it or put it to unrelated uses of its own.

The last row answers a common question about licensing. When a company licenses records to an AI developer that will use them for its own training purposes, any personal data left in the delivery would generally reach the licensee as an independent controller. That is one reason de-identification and redaction requirements are agreed with the company before any work begins, and why data is delivered only after an executed agreement and the company's authorization.

Am I a controller or a processor? A self-test

Answer per dataset, not for the company as a whole.

• Did we decide to collect this data for our own business reasons?
• Do we decide how long it is kept and who can see it?
• Would we still hold it if a particular client left?
• Is it about our own staff, our own customer relationships or our own operations?
• Does a client contract say we process it on the client's behalf, or limit us to using it to provide a service?
• Did a client upload, send or own the underlying material?

If the first four answers are yes and the last two are no, the company is probably the controller of that dataset. If a client contract limits its use, treat the data as the client's.

Examples by business type

Every row depends on contracts. An MSP's own ticket system, for example, may still contain client confidential information, so client agreements matter even for records the MSP controls. The licensing screen is also wider than privacy law: non-personal client material, such as a client's documents or code, belongs to the client unless a contract says otherwise.

Why this is the first screen for data licensing

SourceX treats data that belongs to someone else as a red flag: an outsourcer's or agency's client records, licensed without those clients' consent, are not a licensable asset. Even a company that controls its records has to check what it promised. FTC staff have warned that adopting more permissive data practices, such as using consumers' data for AI training, and telling people only through a surreptitious, retroactive change to terms of service or a privacy policy could be unfair or deceptive (FTC Technology Blog, February 2024).

The strongest candidates are usually a company's own operational history: internal email and chat, its own CRM and support records, finance and project files. Old archives that nobody uses are often controller data that has never been reviewed; what dark data is explains why they matter. And because a license grants rights without handing over ownership, the company keeps its records, as licensing vs selling data sets out.

Limits and open questions

• A contract label helps but does not settle the question; what each party actually does matters.
• GDPR can apply to organizations outside the EU that offer goods or services to, or monitor the behavior of, people in the EU.
• Other US state privacy laws use their own terms and thresholds.
• Health information adds HIPAA's own categories, covered in PII vs PHI.
• Employee data raises notice and employment-law questions even when the company is the controller.

This is general information, not legal, tax or financial advice. Confirm with your own counsel or privacy officer before acting.

Next step

Owners can run a preliminary screen with the company fit checker and read the who qualifies baseline: a US company with 50+ full-time employees at peak (contractors excluded), years of documented operations, rights to what it would license and an authorized sponsor. Apply at sourcex.si/apply. Advisors who know a company whose own records pass this screen can register as a partner and make the introduction.