What Is a Data Controller? Who It Is in Your Business, and Who It Becomes When Staff Use AI

A data controller is whoever decides the purpose of processing personal data and the essential means of doing it: which data, about whom, kept for how long, shared with whom. In an Irish small business that is almost always the company or the sole trader, and the controller is the one the Data Protection Commission holds to account.

Thursday, 4.50pm, a six-person architecture practice in Galway. A client in her seventies needs a ground-floor bedroom extension, and the planning file includes her occupational therapist's report on why. To save twenty minutes, the architectural technologist pastes the report into ChatGPT on his phone and asks for a summary. It is a good summary. The next morning the client rings with one question: "Who has my medical report now?" The principal's honest first answer was "us". The full answer turned out to be longer.

The legal definition, in plain English

Article 4(7) GDPR defines the controller as "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data". Strip out the legal furniture and it is one test: who decides why this data is being used, and how?

The European Data Protection Board's Guidelines 07/2020 on controllers and processors add that roles follow what actually happens, not what a contract calls you, and that a supplier choosing servers or software does not make it a controller.

Who is the data controller in a business?

The organisation, not a person inside it. In the Galway practice, the controller is the practice: the limited company if it is incorporated, or the principal if she trades as a sole trader. The technologist is not a controller; he acts for one. Neither is a data protection officer, who advises the controller. The DPC's own FAQ puts it simply: the controller decides, the processor acts on the controller's behalf.

One Irish detail people still ask about: you do not register as a controller. The old registration system ended when the Data Protection Act 2018 commenced on 25 May 2018.

The primary role of a data controller: accountability

Accountability. Article 5(2) says the controller "shall be responsible for, and be able to demonstrate compliance with" the data protection principles, and Article 24 requires "appropriate technical and organisational measures" to back that up. In practice the role breaks down into a handful of jobs.

Most small firms do not need a data protection officer: Article 37 requires one only for public bodies and large-scale monitoring or special-category work. The duties above apply regardless.

Data controller, processor and joint controller

One business can hold several of these roles for different jobs.

Joint control comes with a written arrangement under Article 26, and the bar is lower than people expect. In Fashion ID (C-40/17, 2019), the EU Court of Justice held that a clothing retailer was a joint controller with Facebook simply for embedding a Like button on its website. I covered the processor side of the split in detail in What is a data processor under GDPR?; this post stays with the controller.

You are, for the client data your staff put in. What changes is the AI vendor's role. On a business plan with a signed data processing agreement, the vendor is usually your processor. On a personal login, the vendor is a controller in its own right, and your client's data has gone to a third party you never appointed.

The vendor's role depends on the plan, not the product

The Galway technologist used his own free ChatGPT account. For users in Europe, OpenAI's EU privacy policy names OpenAI Ireland Limited, in Dublin, as the controller of that conversation, and consumer chats can be used to improve its models unless the user switches that off. On ChatGPT Business, Enterprise or the API, the roles flip: under OpenAI's data processing addendum, the customer is the controller and OpenAI processes on its instructions.

The third row is the one people miss. Article 28(10) says a processor that starts deciding purposes and means for itself "shall be considered to be a controller in respect of that processing". Even enterprise products contain these carve-outs: Microsoft's Copilot enterprise data protection page says Microsoft is a processor for prompts and responses, but acts as an independent data controller for the Bing web searches Copilot sends on your behalf.

Shadow AI makes this the normal case, not the edge case

The personal-login row is not rare. Microsoft and LinkedIn's 2024 Work Trend Index found that 75% of knowledge workers use AI at work. It also found that 78% of those users bring their own AI tools. Cyberhaven's Q2 2024 AI adoption report, built from real workplace data flows rather than a survey, found 73.8% of ChatGPT accounts used at work were non-corporate. Closer to home, the Small Firms Association reported in 2025 that 92% of Irish small firms using AI rely on off-the-shelf tools such as ChatGPT and Copilot.

In a six-person practice, someone is probably already doing what the technologist did. The DPC's guidance on AI and large language models (July 2024) tells organisations to understand "where the personal data goes" and whether it "is retained by the provider of the AI product or re-used in any way".

What the controller still owes after the paste

The responsibility does not travel with the data. The practice is still the controller of the client's report, so the duties in the first table still apply to it. The client's access request has to list who received her data. The privacy notice probably never mentioned an AI chatbot. And because an occupational therapist's report is health data, a special category under Article 9, the practice has to decide whether the disclosure is a breach it must report to the DPC within 72 hours. I explained how to make that call in What is a confidentiality breach under GDPR?

Small controllers do get fined. The DPC's published decisions include €1,500 for MOVE Ireland and €15,000 for Fastway Couriers, alongside the headline numbers for big tech. Either way, the practice spends the week on paperwork instead of drawings.

Being the controller is not the problem; the chain of other parties you cannot see is. Our Local AI service shortens that chain to one link: you, the controller, running the model on a machine you own, in your own office.

Local AI is a dedicated computer installed at your premises, running open-weight models, with private chat, document search and custom assistants on it. When the technologist summarises a report, the summary is written in the back room, not on a vendor's servers, its sub-processors' servers or a data centre somewhere else. Nothing is sent to us or anyone else to produce the answer.

The same controller duties, two set-ups

The last two rows are where I will not oversell it. You remain the controller, which means the machine still needs securing, staff still need a policy, and nobody should send a planning submission an AI drafted without reading it. What disappears is the part you could never control: another company's servers, its retention schedule and its next change of terms.

What it looks like in an architecture practice

• Private chat for drafting planning cover letters, summarising consultant reports and rewording responses to further-information requests.
• Document spaces for the practice's specifications, building regulations guidance and past submissions, searchable with citations back to the page.
• Custom assistants for the jobs that repeat: the fee proposal, the site visit report, the client brief questionnaire.

We launched the service in September, so I will not claim a year of results. What I can say precisely: the AI step drops off your processor list and your privacy notice's recipients. AgentHub becomes a processor only for any support access you choose to grant, under an agreement scoped to exactly that.

Where the cloud is the right tool, we say so. Answering the phone while everyone is on site is a job for our cloud AI Receptionist, which books meetings without opening a client file.

What is a data controller in simple terms?

A data controller is whoever decides why and how personal data is used. If your business chooses what client data to collect, what to do with it and who sees it, your business is the controller, and it carries the legal responsibility under GDPR for handling that data properly.

Who is the data controller in a company?

The company itself, as a legal person, not an individual employee or the data protection officer. Staff act on the controller's behalf. For a sole trader, the sole trader is the controller. For a partnership, it is normally the partnership.

What is the primary role of a data controller?

Accountability. Under Article 5(2) GDPR the controller must comply with the data protection principles and be able to prove it: a lawful basis, a privacy notice, answering rights requests, contracts with processors, records, security, and reporting breaches to the DPC within 72 hours.

What is the difference between a data controller and a data processor?

The controller decides why and how personal data is processed. The processor handles it on the controller's behalf and follows its instructions, under an Article 28 contract. A payroll bureau or a cloud backup provider is a typical processor for a small business.

Can a company be both a data controller and a data processor?

Yes, for different processing. An IT supplier is a controller for its own staff and customer records, and a processor for the client data it hosts for others. If a processor starts using client data for its own purposes, Article 28(10) makes it a controller for that use.

Do I need to register as a data controller in Ireland?

No. Ireland ended controller registration when the Data Protection Act 2018 commenced on 25 May 2018. You still have every controller duty. If you appoint a data protection officer, you notify the DPC of their contact details.

Is OpenAI a data controller or a processor when my staff use ChatGPT?

It depends on the plan. On personal Free or paid accounts, OpenAI Ireland Limited is the controller of the conversation. On ChatGPT Business, Enterprise or the API, with OpenAI's data processing addendum, your business is the controller and OpenAI is your processor.

What to check this week

1. Name the controller. Write down which legal entity it is: the company, the partnership or you as a sole trader.
2. List the AI tools actually in use, including personal logins.
3. Sort each into a row of the table above. Personal accounts used for client work are the ones to stop first.
4. Check your privacy notice and records name every AI vendor on a business plan.
5. Write a one-page AI policy saying which tools may see client data. This is not legal advice; for a real incident, ask a solicitor.

Back in Galway, the principal rang the client back with the full answer, logged the incident in the practice's breach register, and worked through the 72-hour reporting decision with its adviser. Deleting the chat did not undo the disclosure; it only stopped it getting older. The next occupational therapist's report was summarised on a machine in the back office. The client's question now has a one-word answer again: "us".

If you want to see that set-up in your own practice, book a Local AI consultation; I read every enquiry myself. Or open the chat on this page. It is a cloud agent, so do not paste a client file into it, which, after this post, you were never going to do.