As a data controller, you are obliged to comply with the data protection rules and generally ensure that the personal data that you process is adequately protected.
The data protection rules contain a number of principles that you as a data controller must always adhere to.
If you are the data controller, you must make sure that the data subjects' rights are observed.