Data controller vs data processor

UK GDPR splits responsibility for personal data between two roles. The data controller decides the purposes and means of processing — in an HR-software context, this is the employer, who decides what employee data to collect and why. The data processor processes data on the controller's behalf and instructions — this is typically the software vendor whose system stores and processes that data.

The distinction matters because it determines legal liability. Controllers carry the primary responsibility for lawfulness of processing, and for handling data-subject rights requests (like erasure or access requests) — the processor's job is to support the controller in meeting those obligations, not to make independent decisions about the data. A Data Processing Agreement (DPA) is the contract that formalises this relationship, setting out exactly what the processor may and may not do with the data.

In HR software specifically, this means the employer (the tenant using the software) remains the controller and answers to their employees, regulators and courts for how that data is used — the software vendor's job is to process it securely, only as instructed, and to support the controller's compliance (e.g. helping fulfil an erasure request, subject to any legal retention obligations that override it).