A Data Controller decides why and how personal data is used.

Key Points:
1) Sets data purposes
2) Ensures compliance
3) Responsible for rights requests.

An online shop decides what customer data to collect, and must report any GDPR Breach.