What is the definition of Controller according to GDPR?

According to Article 4(7) of the General Data Protection Regulation (GDPR), a 'controller' is defined as the natural or legal person, public authority, agency, or other body that, either alone or jointly with others, determines the purposes and means of the processing of personal data. The key elements are the decision-making power over why (the purposes) and how (the means) personal data is processed. This entity holds the primary responsibility for ensuring compliance with data protection principles.

A. This describes a Supervisory Authority (Data Protection Authority), as defined in GDPR Article 4(21) and Article 51, not a controller.
C. This describes an entity acting unlawfully. The GDPR defines legitimate roles for data processing, not unauthorized ones.
D. This is the definition of a 'processor' under GDPR Article 4(8), which acts on behalf of and follows the instructions of the controller.

1. Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation), 27 April 2016.

Article 4, Paragraph 7: "‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data..."

Article 4, Paragraph 8: Defines 'processor' as the entity which "processes personal data on behalf of the controller".

2. European Data Protection Board (EDPB), Guidelines 07/2020 on the concepts of controller and processor in the GDPR, Version 2.1, 7 July 2021.

Page 11, Paragraph 22: "The definition of controller is laid down in Article 4(7) GDPR... The controller is the entity that determines the purposes and means of the processing of personal data." This document extensively clarifies the definition and its practical application.