A data controller is the organization that decides why and how personal data is processed under the GDPR, and so carries the main legal responsibility for it.
Category
Privacy
Also known as
controller; GDPR controller
The brand running the marketing is the controller; the CDP or email vendor acting on its instructions is a processor. Two companies that decide together, such as a retailer and a platform sharing pixel data, are joint controllers. That covers the collection and sharing step, not what the platform does afterward. Joint controllers need an agreement that says who does what.
In practice
If you decide the purpose, you are the controller, whatever the vendor's terms say. Write down the purpose for each data flow in the stack; that list is the start of every GDPR document you will be asked for. This is a summary of the law, not legal advice.
Something out of date?