Article 4(7): the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data. Bears the primary compliance burden under GDPR, including the Accountability obligation and Breach notification duty, distinct from a processor, which acts only on the controller’s instructions.