Data-Broker & People-Search Ecosystem
Data Broker vs Data Controller: What's the Difference?
Two terms that sound alike but mean very different things under UK data protection law. Understanding the gap helps you see who is responsible for your information, and who to address when you want to exercise your rights.
In short
A data controller is any organisation that decides why and how your personal data is used. A data broker is a specific kind of controller whose business is collecting and selling information about people it usually has no direct relationship with. Every data broker is a controller, but most controllers are not brokers.
What a "data controller" actually means
Under UK GDPR, a data controller is the organisation that decides the purposes and the means of processing your personal data. In plainer terms, it is whoever is in the driving seat: the party that chooses why your information is collected and how it will be used. Your bank, your employer, an online shop you bought from, and a charity you donated to are all controllers of the data they hold about you.
The label matters because the law attaches most responsibilities to the controller. A controller has to have a lawful basis for using your data, has to keep it accurate and secure, and has to answer when you ask to see, correct, or delete it. When you send a data subject access request or an erasure request, you are normally writing to a controller.
A controller is different from a processor, which is a third party that handles data only on the controller's instructions, such as a cloud-hosting company or a payroll service. The processor follows orders; the controller sets them.
- A controller decides the why and how of using your data.
- Most legal duties, and most of your rights, point at the controller.
- A processor only acts on a controller's instructions and carries fewer duties.
Where the data broker fits in
A data broker is a particular type of controller. Its business model is to gather personal information about large numbers of people, combine it into profiles, and license or sell access to that information. The defining feature is that a broker usually has no direct relationship with the people in its records. You did not sign up with it, and you may never have heard of it.
Because a data broker decides the purposes and means of its own processing, the law treats it as a controller with all the same responsibilities: a lawful basis, accuracy, security, and the duty to respond to your rights requests. The people-search sites and marketing-list companies you might find when you look yourself up online typically sit in this category.
So the relationship is one of nesting, not opposition. "Controller" is the broad legal category. "Broker" is a narrower commercial description of one kind of controller. Every data broker is a controller, but the vast majority of controllers, such as your dentist or your gym, are not brokers.
- A broker collects and sells data about people it has no direct relationship with.
- A broker is still a controller and carries the same legal duties.
- Every broker is a controller; most controllers are not brokers.
Why the distinction matters for your rights
Knowing which kind of organisation you are dealing with helps you set realistic expectations. With a controller you have a relationship with, the context is often clear: you know roughly what data they hold and why. With a data broker, the harder first step is simply finding out that they hold anything about you at all, because the collection happened indirectly.
Your rights, however, are the same in both cases. You can ask either one what they hold about you, ask them to correct mistakes, and in many situations ask them to stop or erase. Under UK GDPR these requests usually go to the controller, whether that controller is a familiar company or a broker you have only just discovered.
This article is general information, not legal advice. Where a broker operates under a different country's rules, the same idea tends to hold under that jurisdiction's own law and regulator, even though the exact wording and time limits vary. If a request is refused or ignored, you can raise the matter with the relevant data protection regulator.
- With a broker, the first challenge is discovering it holds your data at all.
- Your access, correction, and erasure rights apply to both equally.
- If a request stalls, the data protection regulator is your next step.
Frequently asked questions
Is every data broker also a data controller?
Yes. A data broker decides why and how it processes the personal data it collects, which is the legal definition of a controller under UK GDPR. So a broker is simply one type of controller, with all the same responsibilities to handle your data lawfully and respond to your rights requests.
Can a single company be both a controller and a broker?
It can. A company might act as an ordinary controller for its own customers while also running a side business that collects and sells data about other people. The role depends on the specific activity, so the same organisation can wear different hats for different sets of data.
Does it change which rights I have?
No. Your core UK GDPR rights, such as access, rectification, objection, and erasure, apply whether the organisation is a broker or any other controller. The practical difference is usually how easy it is to find the organisation and learn what it holds, not what you are entitled to ask for.
Who do I send a data request to?
You normally send it to the controller, because that is the party responsible for deciding how your data is used. If you are dealing with a data broker, the broker is that controller. Processors generally pass requests back to the controller they work for.
Related terms
This is general information, not legal advice. For guidance on your own situation, consider speaking with a qualified professional.
Reviewed by OSINTA's founding lawyer — 2026-06-27.
Know who holds your data, then ask them about it
Once you can tell a broker from any other controller, sending a clear data subject access request is the calm next step.