The Difference between Data Controller and Data Processor : Case Study of the United Kingdom

Abstract

 Data controllers and data processors have their own obligations under the data protection regulations.  It is important to identify the difference between a data controller and data processor; especially when the breach of personal data occurs.  Who is responsible for the security of personal data or for a the data breach?  In this regard, the United Kingdom personal data regulator has set the tone to consider the difference between data controller and data processor in many aspects.  The major consideration to use for clarifying the difference between data controller and data processor is the power to control personal data, such as identifying what personal data should be collected, setting the purpose of using that personal data, as well as the method to process personal data.  In the meantime, data processors must strictly comply with the data controller’s recommendations about how to process personal data without any consideration of their own.  However, data processors can use their professional techniques to protect personal data.  In this matter, Thailand can adopt best practices of the United Kingdom to identify the difference between data processors and data controllers, which will help to reach the goal of personal data protection.