30In that regard, it must be stated that, having regard to the broad definition of the concept of ‘controller’ within the meaning of point 7 of Article 4 of the GDPR, the determination of the purposes and means of the processing and, where appropriate, the nomination of that controller by national law may not only be explicit but also implicit. In the latter case, that determination must nevertheless be derived with sufficient certainty from the role, task and powers conferred on the person or entity concerned. The protection of those persons would be undermined if point 7 of Article 4 of the GDPR were interpreted restrictively to cover only those cases in which the purposes and means of the data processing performed by a person, a public authority, an agency or a body are expressly determined by national law, even where those purposes and means are apparent, in essence, from the legal provisions governing the activity of the entity concerned.
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.