This article is an interdisciplinary work focusing on the field of law and management, specifically management in determining the role of a given entity that processes personal data for the controller or processor, in which the author has attempted to present the factors that determine the impact on what role a given entity should assume, moreover, what is the difference in the risk borne by the controller, and to prove that the risk of misdetermining the role of the controller or processor exists and takes place despite many guidelines and the GDPR regulation itself. At the outset, the paper introduces the concept of controller and processor and the differences between these entities. Then the issue of confusion related to the misidentification of the role of controller or processor is addressed using selected examples.