The test is who decides, not who stores
A data controller is the person or organisation that decides why personal data is processed and how it is used. The test is about decision and purpose, not about who owns the server, the building, or the filing cabinet. If you decide to collect your customers' details and you decide what to do with them, you are the controller — regardless of where the data physically sits.
What a processor is
A processor is someone who handles personal data on the controller's instructions and on the controller's behalf — a payroll bureau, a cloud host, a bulk-SMS provider. The processor follows instructions; the controller remains responsible. Outsourcing the work does not outsource the responsibility. If the processor mishandles the data, the controller still answers for it, which is why processor agreements and due diligence matter.
Most organisations are both
Most organisations wear both hats, for different datasets. You are a controller for your staff records and your customer list. You may be a processor for a client's data when you provide a service to another organisation. The classification is per dataset, not per organisation, and it is common to be both at once.
Why the classification matters
The classification decides everything that follows: who must be licensed, who appoints the DPO, who issues privacy notices, who answers data subject requests, and who is liable when something goes wrong. Getting the classification right at the start prevents a chain of obligations being assigned to the wrong party — and prevents the most expensive mistake, which is assuming that because someone else holds the data, someone else is responsible.
Sources: Cyber and Data Protection Act 5 of 2021 [Chapter 12:07]; Statutory Instrument 155 of 2024.
This is general guidance, not legal advice. Your licence category is determined by POTRAZ on assessment of your application.