controller
noun · Verantwortlicher
In data protection the controller is the Verantwortlicher, the body that alone or jointly with others decides on the purposes and means of the processing, Art. 4 Nr. 7 DSGVO. The word is a role, not a job title: it is not the German Controller of the finance department and not a Kontrolleur, and the whole burden of GDPR duties attaches to it.
Which translation, when
Why
The controller of the GDPR is the Verantwortlicher, and the term is fixed by the equally authentic German text of the regulation, so a translation has no room to improvise. Art. 4 Nr. 7 DSGVO defines the Verantwortlicher as the natural or legal person, public authority, agency or other body which, alone or jointly with others, decides on the purposes and means of the processing of personal data. Everything in the regulation hangs on that role: the Verantwortlicher must comply with the processing principles and be able to demonstrate compliance, the accountability rule of Art. 5 Abs. 2 DSGVO, carries the general responsibility for appropriate technical and organisational measures under Art. 24 DSGVO, answers the data subject’s rights, and is the primary addressee of supervisory measures and fines. Where two or more bodies decide jointly, they are gemeinsam Verantwortliche under Art. 26 DSGVO, and where a service provider processes on instructions, the overall responsibility still stays with the Verantwortlicher. The translation trap is the German everyday meaning of the English word: a Controller in a German firm is a management accountant, and a Kontrolleur is an inspector, so an untranslated controller or a rendering as Kontrolleur places the term in the wrong profession and strips it of the legal role. The role also follows the facts, not the label: a body that in fact decides on purposes and means is Verantwortlicher whatever the contract calls it. So the safe rendering is Verantwortlicher, every time, and the word should be read as a bundle of duties rather than a description of activity.
Typical mistakes
- Verantwortlicher is the fixed statutory term of the equally authentic German text, so leaving controller untranslated invites the finance-department reading of the German word Controller.
- A Kontrolleur is an inspector, not the bearer of the GDPR duties, so rendering controller as Kontrolleur detaches the term from the role that carries accountability and fines.
- The role follows the factual decision on purposes and means, Art. 4 Nr. 7 DSGVO, not the contractual label, so a party can be Verantwortlicher although the contract calls it something else.
What matters
Rendering a data protection text, the translation should use Verantwortlicher for the controller wherever the GDPR role is meant, keep gemeinsam Verantwortliche for joint controllers, and avoid Kontrolleur and the untranslated Controller, which in German name an inspector and a management accountant.
What the machine misses
Machine output may leave controller untranslated, which a German reader takes for the management accountant of the finance department, or render it as Kontrolleur, an inspector. Both cut the word off from the statutory role of Art. 4 Nr. 7 DSGVO that carries the accountability, the duties and the fines. In technical surroundings the output can even drift to Steuerung, a device. The rendering misplaces who owes the GDPR duties.
Examples
| the controller determines the purposes and means of the processing | der Verantwortliche entscheidet über die Zwecke und Mittel der Verarbeitung |
| joint controllers | gemeinsam Verantwortliche |
| the obligations of the controller | die Pflichten des Verantwortlichen |
| notification to the controller | Meldung an den Verantwortlichen |