The data controller decides the reasons for which and the means by which individual information is handled. Thus, if your organization/organization chooses 'why' and 'how' the individual information ought to be handled it is the data controller. Employees handling individual information inside your organization do such to satisfy your undertakings as a data controller.