Processor or controller under ISO 27701?
Under ISO 27701, everything depends on your role. A controller determines the purpose and the means of processing personal data. A processor processes that data on behalf of another party, based on documented instructions. Your role determines which measures from the standard apply to you. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) describes both roles in detail. In the GDPR you will find them in Article 24 (controller) and Article 28 (processor). The precise requirements for each role are on requirements of ISO 27701. You can access the standard itself via ISO .
The difference in one table
| Characteristic | Controller | Processor |
|---|---|---|
| Decides on purpose | Yes | No |
| Decides on means | Yes | No, follows instructions |
| Legal basis | GDPR Art. 24 | GDPR Art. 28 |
| Example | Webshop with customer data | Hosting provider of the webshop |
| Another example | HR department with employee data | Payroll administrator acting on instruction |
| ISO 27701 measures | 31 + 29 shared | 18 + 29 shared |
How do you determine your role?
Ask yourself the first question: do you decide why the data is processed?
Do you decide which personal data is collected and for what purpose? Then you are probably a controller.
Example: an insurance company decides which health data it collects for risk assessment. It determines the purpose and the means. It is the controller.
Second question: do you process data solely on the instructions of another party?
Do you carry out processing that another party instructs, and are you not allowed to change the purpose or approach yourself? Then you are a processor.
Example: a hosting company stores data for the insurance company. The hosting company processes on instruction and decides nothing itself. It is a processor.
Third question: are you both?
This happens more often than you might think. Many organisations are a processor for customer data and a controller for their own employee and prospect data.
Example: an HR SaaS platform processes salary data of employees of its clients (processor), and also the company’s own CRM data on prospects and employees (controller). Both roles apply at the same time.
Getting the role wrong has consequences. If you consider yourself a processor but in practice make decisions about purpose and means, you are legally a controller. That means different obligations and different liability. Unsure? Have a privacy lawyer review it.
Which measures belong to which role?
ISO 27701 divides the 78 controls in Annex A into three groups based on your role.
| Group | Number | For whom |
|---|---|---|
| Controller controls | 31 | Controllers only |
| Processor controls | 18 | Processors only |
| Shared controls | 29 | Both roles |
The 31 controls for controllers cover matters such as: having a valid legal basis for every processing activity, being transparent towards data subjects through a privacy notice, handling requests (access, correction, erasure), complying with retention periods, and rules for sharing data.
The 18 controls for processors cover: working on the basis of documented instructions from the controller, supporting the controller with its obligations towards data subjects, and ensuring confidentiality with sub-processors.
The 29 shared controls are information security measures that apply to both. With standalone certification (without ISO 27001), you also record these explicitly.
Read the full explanation on requirements of ISO 27701.
The data processing agreement: mandatory with every processor
If you have personal data processed by a third party, you are legally required to conclude a data processing agreement. This is set out in Article 28 of the GDPR. No agreement, no lawful processing.
The data processing agreement records:
- Which categories of personal data are processed
- Which purpose and which instructions apply
- How the processor handles security incidents
- Which sub-processors may be engaged
- How and when data is returned or destroyed
ISO 27701 turns data processing agreements into a control: you record them, you manage them, and you periodically check whether they are still correct. Many organisations lack agreements with cloud tools and HR software. That is a common mistake in an audit. The full checklist with example clauses is on data processing agreement: what should it contain?
What changed in the 2025 version?
In ISO 27701:2019, the controls for controllers were in Annex A and the controls for processors were in Annex B. In the 2025 version, these are combined into one Annex A, in three clearly named groups.
Annex B now contains practical implementation guidance instead of a separate set of controls. That makes the structure clearer. For how all the changes relate to each other, read ISO 27701 vs ISO 27001.
Next steps
How the standard aligns with the GDPR.
GDPR and ISO 27701How do you set up the system?
The PIMS explainedWhich organisations need ISO 27701?
Who is ISO 27701 for?The full control structure.
Requirements of the standardOverview of ISO 27701.
Back to the hubSources
- Dutch Data Protection Authority (Autoriteit Persoonsgegevens) – Dutch supervisory authority for personal data
- GDPR – Article 28 (EUR-Lex) – obligations for processors
- ISO/IEC 27701 at ISO – International Organization for Standardization