A controller asserts that only processors can receive administrative fines under the GDPR. What is the correct position?

A controller asserting that only processors can receive administrative fines is wrong: controllers and processors can each face administrative fines for their own GDPR infringements. Public enforcement reaches whichever actor breached duties owed to people—not a one-sided ‘processors only’ myth that would leave determining controllers untouched. Saying neither controllers nor processors can ever be fined, and only data subjects pay penalties, fails by inverting who Article 83 targets. Claiming only joint controllers outside the EEA are finable fails geographically and conceptually. Asserting processors are immune once a controller signs any service brochure fails—commercial marketing gloss does not create immunity from processor duties. Exam caveat: liability tracks the provisions each party infringes; controllers cannot outsource accountability entirely, and processors remain exposed for their own Article 28/32-type failures. Operational check: allocate contractual responsibilities clearly, audit both controller and processor control failures after incidents, and budget fine risk for each role rather than assuming the other party absorbs all exposure. In public-interest terms, documenting the lawful analysis, assigning owners, and retaining evidence of how individuals were protected is how organisations demonstrate accountability when supervisory questions arrive.