Data Controllers can be a company or other legal entity or an individual that make decisions regarding processing activities. They are responsible for the overall control of the personal data being processed and are ultimately responsible for the processing.
Data Processors act on behalf of a Controller, under their authority. To this end, they must serve the controller's interests, and not their own. Processor's have a more limited compliance responsibility. However, a Data Processor acts outside of the Controller's instructions, in such a way that determines the means and purpose of the processing, the Processor will become a Controller in respect of the processing, and can face the same liability as a controller.
"'Controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. ‘Processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller."
→ A GUIDE TO DATA PROTECTION | INFORMATION COMMISSIONER'S OFFICE (ICO)