It depends on the context of the relationship. Sometimes we are a Data Controller e.g. if we work directly with an individual to carry out a screening check for them then we are most likely the Data Controller. Whereas, if we work with a business and carry out screening checks for a number of their employees or prospective employees then