Understanding the Difference Between Information You Process and Information You Control

Managing information for clients whilst also running your own business can make it difficult to understand where responsibilities begin and end.

A business is a data controller when it decides why and how personal information will be used. It is a data processor when it handles personal information on behalf of a controller and in accordance with the controller’s instructions.

The role is determined by the purpose of each processing activity—not simply by who holds the information, whose system it is stored within or whose customer the information concerns.

Understanding this distinction helps businesses define their responsibilities, establish clearer client arrangements and manage personal information with greater confidence.

The Situation

A sole trader providing virtual assistant and remote secretarial services to several small businesses.

Their work included managing calendars, responding to emails, maintaining customer contact details, taking meeting notes and updating client systems and customer relationship management records.

Alongside this work, the sole trader also collected and created information needed to operate their own business, including enquiries, quotations, contracts, invoices, supplier information and accounting records.

The Challenge

Managing information for clients whilst also running their own business made it difficult for the sole trader to understand where their responsibilities began and ended.

Some personal information was handled solely on a client’s instructions. Other information was collected or created for the sole trader’s own business purposes. In some cases, both types of information were held within the same email account, device or online service.

The sole trader needed to understand when they were acting as a data processor and when they were acting as a data controller.

Mature businessman working on a laptop in a modern office, feeling stressed, confused, and

What We Found

When the sole trader handled personal information on a client’s instructions and for purposes determined by that client, they were acting as a data processor.

This included activities such as:

managing a client’s calendars and appointments;
responding to emails on the client’s behalf;
maintaining the client’s customer or contact records;
preparing documents using information supplied by the client; and
updating the client’s systems and CRM records.

However, when the sole trader decided why and how information was used to operate their own business, they were acting as a data controller.

This included information relating to:

sales enquiries and prospective clients;
quotations and contracts;
client relationship and service-management records;
invoices, payments and accounting;
suppliers and professional advisers; and
records needed to demonstrate the work undertaken.

The sole trader could therefore be a processor and a controller within the same client relationship, depending on the purpose for which particular information was being used.

Our Approach

We worked with the sole trader to identify the different categories of information they handled and the purpose served by each one.

For each activity, we considered:

who decided why the information was being used;
who decided how it would be managed;
whether the sole trader was following a client’s instructions;
whether the information was required to operate the sole trader’s own business;
who was responsible for responding to information-rights requests; and
what should happen to the information when the client relationship ended.

This allowed the sole trader’s controller and processor responsibilities to be clearly distinguished and reflected in their working practices, service agreements, privacy information and retention arrangements.

Image by Christina @ wocintechchat.com M

The Outcomes

The sole trader gained a clearer understanding of their responsibilities for the different information they handled.

They could identify when they were:

acting as a processor, managing personal information on behalf of a client; and
acting as a controller, determining how personal information was used for their own business purposes.

This helped them establish clearer arrangements with clients for accessing, protecting, retaining, returning and deleting information.

It also enabled them to explain their role more confidently, demonstrate professional information management and provide greater assurance to their clients.

To support these outcomes, we developed:

A Records of Processing Activities (RoPA) providing a structured view of how personal information was used throughout the business.
An updated Privacy Notice explaining what information is collected, why it is required, who it may be shared with and how it is protected.
Information handling guidance supporting the secure management of client information.
Client onboarding procedures helping demonstrate a professional approach from the beginning of each engagement.
Practical Subject Access Request procedures reducing the effort required to respond to customer enquiries.
Retention guidance supporting the review and secure disposal of information that was no longer required.