> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.laposta.org/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.laposta.org/_mcp/server.

# What is the difference between controller and processor?

> Read about the difference between data controller and processor under the GDPR, and which data you are allowed to store in Laposta.

When you outsource the sending of newsletters, another organisation processes personal data on your behalf. The GDPR distinguishes two roles in this context, each with its own rights and obligations. The difference lies in who determines what happens to the personal data.

The controller determines the purposes and means of processing personal data. If your organisation decides why and how personal data is used, then your organisation is the controller. When sending your newsletter, this is your own organisation.

The processor processes personal data on behalf of the organisation that engages it. Laposta fulfils this role: Laposta processes the data of your subscribers, but you decide what happens to it.

## Agreements in the data processing agreement

To avoid assumptions and misunderstandings, the division of roles and the associated rights and obligations must be clear. Laposta has explicitly laid down this relationship of authority and these agreements in a [data processing agreement](/wat-is-een-verwerkersovereenkomst).

As the controller, you are responsible for ensuring that you do not store any data in Laposta other than what has been agreed in the data processing agreement. Laposta broadly checks whether no more personal data is processed than has been agreed.

> **Warning**
>
> Laposta is explicitly not suitable for processing special categories of personal data. Examples include medical data, criminal record data, or data concerning religion, sexual orientation, or membership of political organisations.

## Related articles

#### [What agreements are included in a data processing agreement?](/wat-is-een-verwerkersovereenkomst)

What agreements you make about processing personal data and how Laposta handles your data.

#### [What does the GDPR mean for your newsletter?](/privacywetgeving)

Which rules apply to collecting email addresses and how Laposta protects your data.

#### [What standard roles and permissions are there in Laposta?](/welke-rollen-onderscheidt-laposta-voor-gebruikers)

Overview of the seven standard roles in a paid account and the corresponding…

#### [Viewing the permissions of your own login](/welke-rechten-heb-ik-in-mijn-account)

View on the Access page which role and permissions you have in your account, and ask…