Data controller vs processor at borders

Last checked: 21 October 2026 · Rules and oversight

A data controller is the body that decides why and how personal data is processed. A data processor handles the data on the controller's behalf ¹. In border systems, airlines send passenger data to state authorities. EU law names air carriers and border authorities as separate controllers, and names the EU agency eu-LISA as processor for the central API router ². Kenyan rules require a written contract between a controller and its processor ⁵.

Controller test: Determines the purposes and means of processing, alone or jointly with others ¹
Processor test: Processes on behalf of the controller, on documented instructions ¹
EU API router: Member States are joint controllers and eu-LISA is the processor ²
Air carriers under EU API rules: Separate controllers for the API data they process ^2,3
EU body that receives PNR: A Passenger Information Unit in each Member State ⁴
Kenya contract rule: Written contract required, data deleted or returned at the end ⁵

What the two roles mean

The European Data Protection Board (EDPB) adopted Guidelines 07/2020 on 7 July 2021. They describe the controller as the body that "alone or jointly with others, determines the purposes and means of the processing of personal data" ¹. Purposes and means are the "why" and the "how" of processing ¹.

The EDPB splits means into two kinds. Some, such as which data are processed and for how long, are reserved to the controller. Practical choices, such as the type of hardware or software, can be left to a processor ¹.

A processor that goes beyond the controller's instructions breaks the GDPR, according to the EDPB. If a processor starts to decide its own purposes and means, it is treated as a controller for that processing ¹.

Who holds which role in API and PNR flows

Advance passenger information (API) covers identity and flight details. Under Regulation (EU) 2025/12 of 19 December 2024, API data include surname, given names, date of birth, sex, nationality, travel document details, the PNR record locator, seat and baggage information where available, and flight data such as flight number and airports ².

Recital 36 of that regulation says air carriers are separate controllers for the API data they process. Competent border authorities are separate controllers for their own processing. Member States, through designated authorities, are joint controllers for processing in a central router. eu-LISA, the EU agency for large-scale IT systems, is the processor for data passing through the router ². Article 11 says eu-LISA shall design, develop, host and technically manage the router ².

Regulation (EU) 2025/13 sets a parallel model for law enforcement. Air carriers send encrypted API data to the router, which passes it to Passenger Information Units (PIUs) without changing its content. Air carriers and PIUs are separate controllers and eu-LISA is the processor for the router ³.

For passenger name record (PNR) data, Directive (EU) 2016/681 requires each Member State to establish or designate a PIU. The PIU collects and stores PNR data from air carriers, processes it and passes data or results to competent authorities ⁴.

Party	Role under EU API rules
Air carrier ²	Separate controller for the API data it processes ²
Designated Member State authority ²	Joint controller for processing in the router ²
Border authority ²	Separate controller for its own API processing ²
Passenger Information Unit ³	Separate controller for API data received for law enforcement ³
eu-LISA ²	Processor for API data passing through the router ^2,3

What a controller and processor contract must cover

The EDPB guidelines list the terms that Article 28(3) of the GDPR requires. The processor must process data only on documented instructions from the controller. The contract must cover confidentiality, security measures under Article 32, the conditions for using sub-processors, help with data subject requests, help with Articles 32 to 36, deletion or return of data at the end of processing, and information and audits ¹.

In Kenya, the Data Protection (General) Regulations, 2021 were made on 7 December 2021 and published on 31 December 2021 as Legal Notice 263. Regulation 24(1) says a controller must use a written contract to appoint a data processor. The contract must provide that all personal data must be permanently deleted or returned on termination, as decided by the controller ⁵. Under regulation 25, a processor may not bring in a third party without the controller's prior authorisation and stays liable to the controller for that third party ⁵.

Kenya's registration rules, Legal Notice 265 of 2021, say every data controller and data processor must register. A controller is a person who determines the purpose and means of processing. A processor handles data for a controller under a contract and has no decision-making power over the processing ⁶. A state department registers and pays fees for its entities, and state corporations must register themselves ⁶.

Country examples

European Union: Regulations (EU) 2025/12 and 2025/13, both dated 19 December 2024, name the controllers and the processor for the API router in their recitals ^2,3.
Kenya: Legal Notices 263 and 265 of 2021 set the contract terms between controllers and processors and require both to register with the Data Protection Commissioner ^5,6.
Philippines: The Data Privacy Act of 2012, approved on 15 August 2012, uses the terms personal information controller and personal information processor. A controller may subcontract processing but remains responsible for personal information under its control, including data sent to third parties in the Philippines or abroad ⁷. Section 4(e) excludes information needed to carry out the functions of a public authority, including law enforcement and regulatory agencies ⁷.
UN goTravel: The UN Office of Counter-Terrorism gives the goTravel passenger data software to Member States free of charge, to operate within their own jurisdiction. The programme states that the UN "will not see, store, or retain any data belonging to each Member State" ⁸.

Common questions

Is an airline a data controller for API data?

Under EU Regulations 2025/12 and 2025/13, yes. Air carriers are separate controllers for the API data they process ^2,3.

Can a technology supplier become a data controller?

Yes. The EDPB says a processor that starts to decide its own purposes and means for processing is treated as a controller for that processing ¹.

Does picking the software make an authority a processor?

No. The EDPB treats the choice of hardware or software as a practical matter a processor can decide. Which data are processed and how long they are kept stay with the controller ¹.

Must a Kenyan government agency register as a data controller?

Yes. Regulation 6 of Legal Notice 265 of 2021 says state departments register and pay fees for their entities, and state corporations register themselves ⁶.

Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email hello@passengerdataexplained.org with the official link.

Sources

Advance Passenger Information (API) explained
What API data is, which fields airlines send, who receives it, the legal basis, how long it is kept, and examples from four jurisdictions.
Passenger Name Record (PNR) data explained
What PNR data is, the 19 EU data elements, who sends and receives it, the legal basis, retention rules and the 2022 EU Court of Justice ruling.
Passenger data clauses in border contracts
The terms that decide who holds passenger data in border systems: data location, fees, funding, gateway providers and what official records publish.
Who oversees passenger data
The bodies that check how governments use API and PNR data: data protection authorities, data protection officers, courts and UN standards.
Where passenger data is hosted
Where governments store API, PNR and biometric passenger records, what laws say about servers and location, and how donated and vendor systems fit in.
Airlines and passenger data
What airlines and their system providers collect, carrier duties and fines for API and PNR, and what airline privacy notices say.