Controller or processor: the classification that determines who is responsible for personal data
Israel’s Privacy Protection Law distinguishes between the party that determines the purposes of processing and the party that processes data on its behalf. The classification determines which duties apply to each party, and a processor that processes data without authorization, or beyond it, commits an offense punishable by three years’ imprisonment.
The definitions in the Law
Amendment 13 to the Privacy Protection Law, 5741-1981, which entered into force on 14 August 2025, updated the definitions. A database controller is whoever determines, alone or together with another, the purposes of processing the data in the database, or a body authorized by legislation to process the data. A processor (in Hebrew, machzik) is a party external to the controller that processes data on its behalf. The Privacy Protection (Data Security) Regulations, 5777-2017, call the processor an “external party”, and the regulations on transferring data abroad call it the “recipient”.
“Processing” is defined in the Law as any operation on personal data, including receiving, collecting, storing, copying, viewing, disclosing, transferring and granting access to it. A provider that only stores the database, or receives access to it for technical support, processes data.
Why the classification matters
Most duties fall on the controller: a lawful basis for processing, notice to data subjects under Section 11, the rights of access and correction, data security, and appointing a privacy officer where the Law requires it. The processor’s duties derive from the authorization it has received.
Processing without authorizationCriminal offense
Under Section 8(c), no person may process personal data from a database without the controller’s authorization or beyond that authorization. The offense in Section 23NH of the Law, punishable by three years’ imprisonment, applies to whoever does so.
Administrative fineFine
Processing for a purpose other than the one set for the database, or without authorization, exposes the violator to a fine of NIS 4 per data subject (NIS 8 where the database contains data of special sensitivity), and at least NIS 200,000.
Data collected unlawfullySource of the data
Under Section 8(d), a controller may not process data that was created, received or collected in breach of the law. A party that received the data from another and did not know, and should not have known, of the defect is not liable until it learns of it.
Agreement with the processorData security
Regulation 15 of the Data Security Regulations requires the controller to examine the processor before engaging it, to sign a written agreement specifying the permitted processing and the security measures, and to monitor compliance.
The classification also affects the duty to appoint a privacy protection officer: a processor whose main activity is systematic monitoring, or processing data of special sensitivity on a significant scale, must appoint an officer itself. See Privacy Protection Officer under Amendment 13.
How to tell them apart
The key questions are who determines why the data is processed, whom the processing serves, and who decides on what the European Data Protection Board (EDPB) calls the essential means: which data is collected, how long it is kept and to whom it is disclosed. A provider can choose the technical means, such as the server, the software and the encryption method, and remain a processor. A provider that decides to use customer data for its own purposes becomes, for that use, a controller.
The Israeli definition refers to purposes only. The GDPR refers to purposes and means. In practice, in Israel too, whoever determines the essential means largely determines the purpose as well.
The classification is made for each processing operation separately. The same organization can be a processor for the customer data it stores and a controller for its customers’ own billing details. The role can also change over the course of the relationship: a provider that continues to use the data after the contract ends, for its own needs, does so as a controller. There may also be joint controllers, where two organizations determine the purposes of processing together.
The Court of Justice of the European Union addressed joint controllership in two judgments. In Wirtschaftsakademie (C-210/16, 5 June 2018) it held that the administrator of a business page on a social network and the network operator are joint controllers of the data collected about visitors to the page. In Fashion ID (C-40/17, 29 July 2019) it held that a website embedding a Facebook “Like” button is a joint controller with Facebook for the collection and transmission of visitors’ data, but is not responsible for what Facebook does with the data afterwards. The ruling is relevant to websites that use social network pixels and share buttons, where the GDPR applies to them.
Examples
| Situation | Possible classification |
|---|---|
| Property management company managing apartments for their owners | When it collects rent and handles tenants according to the owners’ instructions, it is usually a processor for them. When it keeps its own tenant database and uses it for several owners, it is a controller of that database. |
| Condominium building with a management company | The building’s residents’ committee determines why data on residents is collected, such as for collecting building fees and repairs, and is therefore the controller. The management company that collects the fees on its behalf is a processor. |
| Urban renewal project | The developer that collects apartment owners’ details in order to sign them up and advance the project is a controller. A project management company that processes the data for it is a processor. The apartment owners’ lawyer is an independent controller of the data received from clients. |
| Law firm and its cloud client-management provider | The firm is the controller and the provider a processor. A provider that uses client files to train models or develop its own products becomes a controller for that use. |
| Short-term rental platform | The platform is the controller of its users’ data. A host that receives guest details for the stay is an independent controller of the data received, and a company managing the property for the host is a processor. |
| Joint marketing campaign by two companies | Where two companies decide together which details to collect from participants and why, they may be joint controllers. |
EU and US law
The EU General Data Protection Regulation (GDPR) defines the Controller in Article 4(7), as the party determining the purposes and means of processing, and the Processor in Article 4(8), as the party processing data on its behalf. Under Article 28, the Processor acts only on the Controller’s documented instructions, and their contract must include the elements the Article lists. Article 28(10) provides that a processor that infringes the Regulation by determining the purposes and means of processing itself is considered a Controller for that processing. EDPB Guidelines 07/2020 explain how to distinguish between the roles, including the distinction between essential and non-essential means.
In California, the CCPA distinguishes between a Business, which determines the purposes and means of processing, and a Service Provider or Contractor, which processes data on its behalf. The contract with the service provider must prohibit it from selling or sharing the data, and from using or retaining it outside the business relationship with the Business.