Under the ICO’s guidance, a controller determines the purposes and means of processing personal data. Assess the role for the particular activity. Buying software does not, by itself, explain who makes those decisions. Source: ICO: controllers and processors

A travel example

For an illustrative agency enquiry process, ask who decides which customer details are collected, why they are needed and how they will be used. Map those decisions before assigning roles. The example is a way to investigate responsibilities, not a legal conclusion about a particular business.

Questions to take to your provider

Ask what the provider does with the information, whose instructions it follows and whether it uses any data for its own purposes. Document the answers by activity. This is more useful than relying on a single label covering every service and data flow.

Read alongside processor

The ICO says a written contract is needed where a controller uses a processor. Use its guidance to inform the contract review. The ICO flags this guidance as under review following the Data (Use and Access) Act 2025, so check the current wording when making a decision. Source: ICO: when a controller–processor contract is needed

Written and updated by Travelgenix. Sources checked on 16 October 2026. Worked examples and checklists are editorial illustrations and recommendations, not customer results.