Critical Mistakes in Distinguishing Data Controllers from Data Processors

⏱️ Reading time: 14 min · 📁 Category: KVKK, GDPR, Data Processing Relations

Critical Mistakes in Distinguishing Data Controllers from Data Processors

A common KVKK/GDPR compliance error is incorrectly distinguishing the roles of
data controller and data processor in actual processing activities.
During 2024-2025, both European data authorities and the KVKK Board described role confusion as a serious risk area, particularly in mixed service models and SaaS infrastructures.

These mistakes cause non-compliance and may even make
the processing activity unlawful through incorrect role allocation.

The Board’s most frequently emphasised point in 2025: “Roles follow actual processing activities, not contractual labels.” 1. Why the Controller–Processor Distinction Matters

Correctly determining what role a company takes in what data processing affects the following obligations directly:

• Duty to provide privacy information
• Determination of consent + processing conditions
• Liability for breach notification
• Security of processed data
• Deletion / anonymization policies
• Audit - contract - additional obligations

If a company claims to be a processor but acts as a controller,
All service offered becomes legally risky.

2. The 7 Most Common Critical Errors in the 2024-2025 Period Error 1: "If the contract says processor, no problem" approach

Many companies assume that the contract label “data processor” is enough.
However, authorities have repeatedly emphasized this principle:

Titles are not determined by contract; they are determined by who, what purpose, and how data is processed.

Example:
A SaaS CRM provider conducts customer behavior analysis, performs user routing in the interface, and makes its own decision on data retention time.
It is then considered a controller, rather than a processor.

Error 2: Overlooking Joint Controllership

Many service models no longer fit into the classic control-processor relationship.
For example:

• Marketplace - vendor relationship
• Banks - fintech underwriting APIs
• Insurer – claims adjuster software
• E-commerce platform - advertising targeting networks

Many of these relationships involve joint controllers.
However, in Turkey, there is a risk of serious violations as most businesses interpret it as a processor.

Mistake 3: Chain misassignment of roles in supply chain

The chain breaks down because suppliers are often mislabeled.

Example chain:

Brand -> Agency -> Advertising technology provider -> Cloud infrastructure -> Analytics tool

Here:

Agency: often controller/controller relationship

Advertising platform: jointly responsible

Cloud service: processor

Analytics: usually controller, because it determines purposes and means

In Turkey, the same model applies to all of them: "Agency is our processor."
This approach became one of the areas that the Board frequently supervised in 2025.

Error 4: Purpose determination of the Processor (most critical error)

If a data processor is doing one of the following activities, it is now a controller:

• If it decides on data retention time alone
• If it decides on new types of analysis
• If it uses data to develop its own product
• Decides which data to collect alone
• If it has authority to share data with third parties

This is especially true in Turkey:

CRM providers

E-commerce marketplace integrations

Chatbot/AI SaaS solutions

Advertising analytics tools

It is very frequent.

Error 5: Leaving technical-organizational measures unclear in contracts

The most criticized topic in many DPA and Board audits:

Using "general expressions" within the data processing agreement (DPA).

Example faulty articles:

"All necessary security measures will be taken."

"Personal data will be stored as long as necessary."

"Delete in accordance with relevant legislation."

These clauses are no longer accepted.
Audits require specific, concrete obligations.

Error 6: Failure to report sub-processor use

Highlights in Board audits in 2025:
Undisclosed use of subprocessors.

Specifically:

Email services (Sendgrid, Mailgun)

Cloud server providers

Log/monitoring tools

Cookie and analytical solutions

That's why the data controller who receives the service can't see the real risks.

Error 7: Uncertainty about who will report violations

Many companies still do not know the answer to this question:

Whose responsibility is the breach notification?

The answer depends on the role:

Controller → notify the Board and data subjects

Processor → immediately notify the controller

Many companies are missing 72 hours because of lack of breach notification SLAs in contracts.

3. Current, Realistic Examples (2024-2025)

The following examples are risk scenarios derived from the authorities' 2024-2025 findings.

Example 1: SaaS platform that says "We only offer CRM"

Status:

The platform analyses customer behaviour.

It forms a segment for customers.

It processes all data for "Product improvement".

Result: controller
Incorrect designation: “processor” → invalid contract → unlawful processing.

Example 2: E-commerce platform - vendor relationship

Platform:

He manages delivery processes.

He does fraud analysis.

It checks the payment flow.

Example 3: Digital marketing agency

Agency:

It sets campaign targeting.

It defines content and target audience strategy alone.

This agency is considered a controller.
However, since the contracts are written "processor", all campaign data is processed unlawfully.

Example 4: Fintech authentication API

API service:

He's developing models of fraud detection.

It expands its own data set.

In this case, a controller.
Many fintech companies in Türkiye present this model as a “processor” relationship → high risk.

4. Eight Common Gaps in Supplier Contracts 1. Roles not explicitly stated

Controller, processor and joint-controller roles are absent or incorrect.

2. No list of subprocessors

Sub-processor appendices are not contracted.

3. No deletion/anonymization procedures

When, by what method, who is responsible is indistinct.

4. Missing audit rights

Procedures for auditing the Processor have not been defined.

5. No SLAs

In particular, the phrase "immediately" is used for the infringement notification, which is insufficient.

6. Abstract technical security measures

Items such as encryption, access control, log management are left "when necessary".

7. Geographical transfer provisions are unclear

The cloud provider's data centers are unspecified.

8. Processing purpose unclear

Broad expressions such as "available for development" are incompatible.

5. What Should Companies Do When Going Into 2026?

The following steps were prepared in accordance with the 2025 guidelines of the authorities:

• Role analysis (RACI) for each data processing activity must be extracted.
• Supplier map must be extracted (martech, fintech, SaaS, cloud).
• Reclassify controller and processor roles.
• Contracts must be revised according to role compliance.
• Compulsory DPA attachments must be prepared for parties who are processors.
• The transparent management of the sub-processor list must be ensured.
• Clarify breach-notification SLAs and the communication chain.

The main audit topic for 2026: “Who is controller, who is processor, and the documentation proving it.”