Data Controller or Data Processor? Confused Roles and Their Consequences

KVKK & Data Responsibility Guide

KVKK often leads to confusion between the roles of Data controller and Data processor. Agencies, CRM providers and other service providers occupy different positions in the data chain. Incorrect classification can create liability and administrative fine risks.

Summary: The controller decides; the processor implements instructions. The service provided can blur that boundary.

1. Basic Definitions (KVKK Article 3)

Role	Definition	Example
Data controller	It is the person or institution that determines the purposes and means of processing personal data.	The brand or company controlling the data
Data processor	A natural or legal person processing data on the controller’s behalf and instructions.	Agency, CRM provider, hosting firm

“The decision-maker is responsible; the implementer is accountable.”

2. Identifying agency and CRM provider roles

• Digital Agency: If an agency only integrates platforms without deciding campaign strategy, it acts as a processor in this scenario.
• CRM provider: A provider hosting customer data and supplying the system is a processor; using those data for its own analytics can make it a controller.
• Influencer management: In the described content-sharing arrangement, the brand is the controller and the agency the processor.

3. Chain of Responsibility in Third Party Services

• Each data transfer creates a "common responsibility relationship".
• A data processing agreement (DPA) is required.
• The processor has data-security obligations under KVKK Article 12.
• If there is a transfer abroad, explicit consent or Board permission is required.

"The weak link in the data chain puts the whole system at risk."

4. Examples of Judicial Decisions

• Authority decision (2022/1023): The email infrastructure provider was penalised as a processor over a log-retention breach.
• Authority decision (2023/331): The CRM provider’s use of customer data for analytics led to its classification as a controller.
• Court decision (2024/215): The absence of a data-transfer protocol between agency and brand resulted in penalties for both parties on shared-responsibility grounds.

5. Checklist to Reduce Risks

• Role-setting should be done in writing at each project start,
• DPA (Data Processing Contract) must be signed,
• Prepare a data flow diagram,
• Prohibit the processor from sharing data with third parties,
• The breach notification procedure must be determined.

B10 recommendation: Define the agency–brand data chain on legal grounds before technical implementation. Record each party’s obligations clearly in the contract.

Clarify your agency's data role.
B10 Digital Agency advises on controller/processor roles, DPA agreements and audits within its KVKK compliance services.

Request advice on data-processing roles My agency only handles advertising, does it count as a data controller?

Not necessarily. An agency that does not decide the purposes of collection or processing is generally a processor. Using data for its own analysis can change its role.

How to determine the difference between a CRM provider and a data controller?

Providing storage and access alone indicates a processor role. Analysing data for interpretation, segmentation or commercial purposes can place the provider in a controller role.

What does common responsibility mean?

Joint decisions on processing may entail joint and several liability in the event of a breach or penalty.

Tags: KVKK • data controller • data processor • CRM providers • agency compliance • DPA • B10 Digital Agency