As per the DSCI Privacy Framework and consistent with definitions in APEC and GDPR standards, a Data Controller (or Personal Information Controller) is defined as:
"A person or organization who controls the collection, holding, processing, or use of personal information. It includes one who instructs another to do so on its behalf." Thus, a data controller determines the "purpose and means" of processing, not merely performing or facilitating storage or sharing.
This is a central concept to ensuring accountability in privacy frameworks, as the controller is the primary entity responsible for compliance with data protection principles.