The GDPR applies to “controllers” and “processors” which are handling the personal data of individuals.  One important thing to notes this that the new regulation applies to ALL organisations collecting and processing the personal data of EU citizens, regardless of where the business is based in the world – businesses across America, Asia, Africa and Australasia will all need to be compliant with the directive if they are handling the personal data of people who live in the EU.

There are two different roles affected by the GDPR: the Controller and the Processor.

The Controller: this is the person, agency or other body who determines the purposes and means of processing the personal data.

The Processor: this is the person, authority or agency which processes the personal data on behalf of the controller.

Basically, a data controller specifies how and why personal data is to be used, while the processor conducts the actual data processing.  The controller is responsible for ensuring the processor sticks to the data protection laws.