A data controller is the organisation that decides why and how personal data is processed. Under UK GDPR, the controller carries the main legal responsibility for handling data lawfully, fairly and securely.
How it differs from a processor
A data processor acts on a controller's instructions and only does what the controller tells it to do with the data. A processor cannot decide to use the data for its own purposes. For example, a technology provider that hosts our systems under contract is typically a processor, while we remain the controller.
Why it matters to you
- The controller is who you contact to exercise your data rights.
- The controller is accountable if something goes wrong.
- The controller chooses the lawful basis for each use of data.
In Credicorp's case
Credicorp is the data controller for the personal data we hold about the directors and contacts of a borrowing company. We are registered with the Information Commissioner's Office. Our privacy notice explains, as controller, how we use your data and how to reach us.
Why it matters for your account
Because Credicorp is the controller for your company's data, we're the ones who decide how it's used and the ones you deal with directly if you have a question or a concern. You don't need to chase a third-party processor or work out who's actually responsible — any request about your data comes straight to us, and we're accountable for answering it properly.
This also shapes how we handle things behind the scenes. When we use a supplier — for example to host records or send communications — that supplier is acting as a processor under our instructions, not making its own decisions about your data. The responsibility for lawful, fair and secure handling stays with us as controller, whoever is doing the technical work.
Related situations
The controller/processor distinction comes up most often when you're asking about a specific right — for instance getting your data in a portable format or objecting to how we use your data. In both cases, it's Credicorp as controller who assesses and responds to the request, even though other parties might be involved in storing or processing the data on our behalf.
If you're ever unsure whether a query is a controller matter or something else entirely — a servicing question, a complaints issue, a request tied to special category data — it's fine to just ask us and we'll point you to the right process rather than you needing to work out the legal categorisation yourself.
See also: Who is the data controller for my information?, Glossary: what does special category data mean?, What are my rights under UK GDPR?.