An organization or person who determines the purpose and means of processing personal data — that is, who decides why and how personal data is collected and used.
The data controller concept comes from European privacy law (GDPR) and is increasingly referenced in Canadian privacy discussions. The controller is responsible for ensuring that personal data is processed lawfully, fairly, and transparently, and that data subjects' rights are respected.
In contrast, a data processor acts on behalf of the controller — for example, a cloud service provider that stores data for a company. The company is the controller; the cloud provider is the processor.
In Canada, PIPEDA uses different terminology but the underlying concept is similar: the organization that collects and uses personal information is responsible for its protection, regardless of whether it shares the data with third parties for processing.
Example: A hospital collects patient health information to provide care. The hospital is the data controller — it determines what information is collected, why, and how it is used. If the hospital uses a third-party software company to manage its records system, that company is a data processor acting under the hospital's instructions.
This is educational information, not legal advice.