Controller or processor: decide it per activity, not per company

A controller determines the purposes and means of processing; a processor acts on documented instructions. A firm running a platform for customers is a processor for the data those customers put into it — and a controller for its own employee records, its marketing list, and the account data of the customers themselves.

The role decides who owes notice, who answers a rights request, who notifies a breach and to whom. Getting it wrong in a contract creates duties you cannot discharge or leaves real ones unowned, and it is far cheaper to determine per processing activity at the start than to unpick later.