Role: controller or processor, and why it decides the duty
The draft applies to organizations that build AI systems or use them. The privacy duty that follows depends on whether the organization decides the purpose and means of processing, or processes for someone who does.
What this page covers
- Controller: the organization decides why personal data is processed and how, including a model trained on its own customer data.
- Processor: the organization processes personal data on behalf of a controller, including a model hosted for a customer.
- Joint: two or more organizations decide together, which is common when a supplier and a customer design the use.
- Both: many organizations are a controller for their own staff and customer data and a processor for a client platform.
How to use it
Settle the role for each AI system and each dataset, not once for the company. Put the determination in the system register with the date and the reasoning.
What it does not add
This page names the role question from ISO/IEC 27701 and the GDPR. It does not decide your role and does not state the law of any country.
A role determination is a legal judgement about facts. Take advice where the answer is not clear, and record the advice.
Read across
Source for this reference page: ISO/IEC 27701:2025, Security techniques, Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management, retrieved 22 October 2026. The note is limited to what the public record states. Every source.