Who Is the Data Controller, and Who Is a Data Processor?

⏱️ Reading time: 11 min · 📁 Category: KVKK & Digital Compliance

Who Is the Data Controller, and Who Is a Data Processor? (KVKK Guide with Examples)

“Who is the data controller under KVKK?”, “What is a data processor?”, “Am I a data controller?”,
“Is an agency a data controller?”, “Is residential complex management a data controller?” Questions like these
are among the most frequently searched and most error-prone topics in KVKK practice.

In this guide, we explain the concepts as simply as possible, with real-life examples and sector-specific explanations
.

📌 Who Is a Data Controller? (Simple KVKK Definition)

A data controller is the person or organisation that decides the following about personal data:

• Why it is processed
• For what purpose it is collected
• How long it is retained
• With whom it is shared

These decisions determine the controller’s role.

💡 The main sentence for SEO is:
The party that makes decisions about personal data is, under KVKK, the data controller. 🧪 Ask Yourself This Question (Fast Test)

If the answer to at least one of the following questions is “yes”, you are most likely a data controller:

• Why am I collecting this data?
• What do I do with this data?
• Do I decide when to delete it?
• Am I making the decision to transfer to third parties?

✅ Who Is a Data Controller? (Clear Examples) 🔹 1) Companies (The Most Frequently Searched Scenario)

Example: A company collects customers’ first and last names, phone numbers, email addresses and billing details and records them in its CRM system.

Result: Company = Data controller
Why? Because the company decides which data to collect, what to use it for and how long to retain it.

Keywords: is a company a data controller, employer as data controller, company liability under KVKK

🔹 2) E-Commerce Sites and Mobile Applications

Example: An e-commerce website registers members, creates orders, shares shipping information and sends marketing emails.

Result: Website owner / App owner = Data controller
Note: Saying “someone else provides the infrastructure” does not remove responsibility. 🔹 3) Apartment Building and Residential Complex Management (Frequently Searched)

Example: Residential complex management records CCTV footage, keeps residents’ contact details and prepares lists of maintenance fees.

Result: Residential complex management = Data controller
Common mistake: “The manager is a volunteer, so KVKK does not apply.” Incorrect. Volunteering does not remove responsibility. 🔹 4) Doctors, Clinics and Hospitals

Example: A clinic collects patient registration forms, keeps examination notes and uses an appointment system.

Conclusion: Clinic / Doctor = Data controller
Patient data is highly sensitive, making the correct design of processes essential.

Keywords: hospital as data controller, doctors’ KVKK liability

🔹 5) Lawyers and Accountants

Example: A lawyer retains client details and prepares a case file.

Result: Lawyer = Data controller
Professional secrecy and specific regulations do not place these activities outside KVKK’s scope. 📌 Who Is a Data Processor? (Simple Definition)

A data processor is a person or organisation that processes personal data:

• Not on its own behalf,
• On the controller’s instructions,
• On the controller’s behalf

These are the defining features of the role.

💡 Main sentence:
The party that does not make decisions and only follows the instructions given is a data processor. ✅ Who Is a Data Processor? (Practical Everyday Examples) 🔹 1) Software Firm / Cloud Service

Example: A company uses CRM software. The software provider hosts and backs up the data and provides technical support.

Result: Software provider = Data processor
Keyword: software provider as data processor 🔹 2) Digital Marketing Agency

Example: The agency sends emails, runs SMS campaigns or manages an advertising dashboard on the company’s behalf.

General rule: Agency = Data processor (if the company determines the purpose and target audience)
⚠️ Exception: When the agency makes independent decisions on "who, when, how", the role may change. 🔹 3) Call Center Companies

Example: A bank outsources its call centre services.

Result: Bank = Data controller · Call centre = Data processor 🔹 4) Payroll and HR Providers

Example: An outsourced payroll provider calculates salaries and submits declarations to SGK.

Result: Payroll provider = Data processor 📊 Data Controller and Data Processor: The Difference (SEO-Friendly Table)

Question	Data controller	Data processor
Who determines the purpose of processing?	✅	❌
Who gives the instruction?	✅	❌
Who acts on instructions?	❌	✅
Who receives a KVKK penalty?	✅	⚠️ (if authority is exceeded or security obligations are breached)
Who registers with VERBİS?	✅	❌

❓ Frequently Searched Questions (FAQ – Traffic Focus) Is an agency a data controller?

In most cases, no; if the company determines the purpose and scope, the agency usually acts as a data processor.

Is residential complex management a data controller?

Yes. It is usually considered a data controller because of camera recordings, residents’ contact details and maintenance-fee processes.

Is the software company responsible for KVKK?

Liability may arise if the provider exceeds its instructions or breaches security obligations. If it stays within its instructions, it generally acts as a data processor.

Can a data processor ever receive a penalty?

Yes. Liability may arise, especially in cases of exceeding authority, security breaches and processing outside the instructions.

❌ Most Common Mistakes

• Assuming “the agency is responsible, not me”
• Failing to establish a written contract and a set of instructions with the processor
• Treating everyone as a data controller or confusing the roles
• Registering incorrectly with VERBİS

✅ Conclusion: If You Are the Decision-Maker, You Are the data controller The KVKK logic is clear:
Decision = Data controller
Instructions = Data processor

If this distinction is made incorrectly, KVKK penalties will be directed at you, and “I did not know” generally does not remove the compliance risk.

Request a Data Controller and Data Processor Role Analysis