One of the first questions an organisation must ask itself when considering its data protection compliance responsibilities is: “Are we controller or processor?” By Emma Erskine-Fox of TLT.