Crucially, data controllers are different to data processors. They have separate and specific requirements to follow, as per GDPR. Data controllers determine exactly what data processors do, with processors working on behalf of controllers. Typically, data processors are third parties external to the main organisation.
Data controllers are also required to pay the data protection fee in the UK, with some exemptions.