According to the General Data Protection Regulation (GDPR) laws, SAP customers are considered data controllers when they use SAP cloud applications. A data controller is a person or organization that determines the purposes and means of processing personal data. A data processor is a person or organization that processes personal data on behalf of a data controller. In this case, SAP is the data processor and SAP customers are the data controllers, as they decide what personal data to collect and how to use it in SAP cloud applications. SAP customers are not considered data controllers when they engage other businesses in the European Union, when they request implementation of a cloud solution, or when they extract legacy data in preparation for migration. These activities do not involve processing personal data in SAP cloud applications.