Who are individuals or organizations that manage personal data?

Prepare for the VTCT Level 2 Facial and Skincare Test. Revise with flashcards and multiple choice questions, accompanied by insightful explanations. Ace your assessment with confidence!

This question tests who has the authority over why and how personal data is processed. Data controllers are the individuals or organizations that determine the purposes for processing personal data and the methods used. In a skincare or facial massage business, the owner or the company usually acts as the data controller, deciding what client information is collected (like contact details, appointment history, or health notes), how long it’s kept, and who can access it. They’re responsible for ensuring processing is lawful, secure, and that clients’ rights are respected, such as the right to access or request deletion. They may engage data processors (like a booking system or CRM) to handle data on their behalf, but the controller remains ultimately responsible. The other options describe pieces of data or storage methods rather than the role that governs data processing.