Outbound Glossary
Controller and processor
Who decides versus who executes. Getting the label wrong puts obligations on the wrong party, and agencies get it wrong constantly.
A controller decides why and how personal data is processed. A processor acts on the controller's instructions. The controller carries the heavier duties, including answering to the people whose data it is.
An agency running outbound for a client is often a processor, but not always: the moment it decides which companies to approach and builds the list itself, it starts making controller decisions of its own. That is worth settling in writing at the start of an engagement, because it determines who answers when a recipient asks where their data came from.