Marketing has signed with an analytics vendor and the vendor's SDK is due in next week's mobile release. Legal asks whether you are the controller or the processor for what that SDK collects. Why does the answer change the architecture rather than only the paperwork?

What the distinction actually decides

A controller decides the purposes and the means of processing. A processor acts only on the controller's documented instructions and may not use the data for anything of its own. The label is not a contractual preference: it follows from who gets to decide what the data is for.

The practical test is one question. Can the vendor use what it collects to improve its own product, build a cross-customer benchmark, or enrich a profile it sells to others? If yes, that vendor is a controller for those purposes, and no data-processing agreement converts it back into a processor. Most analytics, attribution and fraud-scoring SDKs fail this test, because cross-customer learning is their product.

What it forces into the design

• A consent gate before initialisation, not after. If the vendor is a controller, you need your own lawful basis before the first byte leaves the device. That means the SDK cannot sit in the application's start-up path: it is initialised behind a locally evaluated consent flag, and the flag must be readable before any network stack the SDK owns wakes up. Teams discover this late because SDK vendors document init() in Application.onCreate.
• A deletion path you can actually execute. A processor must delete or return data on termination. That is only meaningful if you know what it holds, so the vendor's retention becomes a field in your data inventory, not a clause in a PDF.
• Sub-processor change notification. Your vendor's vendors inherit the obligation. The architecture needs somewhere to record the sub-processor list and a way to act when it changes, because a new sub-processor in a new jurisdiction is a new transfer.
• A breach SLA shorter than your own clock. Under GDPR a controller has 72 hours from becoming aware. If the processor contract gives the vendor 72 hours to tell you, you have zero. The usual number is 24 hours, and it only works if there is a named channel and a rehearsal.

The case people get wrong

Joint controllership. When you and a partner jointly decide the purpose, both are controllers and you owe the person a clear allocation of who answers their request. Architecturally this means a subject access request arriving at either party must be answerable by one of you without a phone call — usually a shared reference identifier and an agreed response owner.

When this is not worth arguing about

For a vendor that never receives personal data, the distinction costs you nothing and the contract can stay generic: a crash symbolication service that takes stack frames and no identifiers, a font CDN, a status page. Spend the design effort where the vendor gets identifiers, device graphs or free-text fields, because free-text fields eventually contain everything.