A controller determines the purposes and means of processing personal data. A processor is responsible for processing personal data on behalf of a controller.