True or false: A data controller may be a natural person or a legal entity, while a data processor must be a legal entity.

The assertion that a data controller may be a natural person or a legal entity, while a data processor must be a legal entity is indeed not accurate. In the realm of data protection under the General Data Protection Regulation (GDPR), a data controller is defined as an entity that determines the purposes and means of processing personal data and can include both natural persons (such as individuals) and legal entities (like companies or organizations).

Conversely, a data processor is an entity that processes personal data on behalf of the data controller. While commonly this role is filled by organizations, GDPR does not explicitly mandate that a data processor must strictly be a legal entity; a natural person can also act as a data processor, so long as they are processing data on behalf of a controller.

Thus, the statement is false, confirming that it mischaracterizes the definitions of these roles under the legislation, validating the answer.