YTYK You think you know

GDPR · pillar 2 of 6

Controller and processor

Who decides the purposes carries the duties. The role follows the decisions, not the contract's title.

  1. 4 The controller is whoever decides why The controller determines the purposes and means of processing; the processor acts only on the controller's documented…
  2. 5 Joint control starts earlier than you think Two parties are joint controllers when they jointly determine purposes and means. That does not require equal…
  3. 6 The processor has duties of its own A processor is not merely a contractual party: Article 28 imposes direct obligations — no sub-processor without…

Start this pillar See the whole map

Read against Regulation (EU) 2016/679 (GDPR), Court of Justice of the EU, Case C-311/18 (Schrems II), 16 July 2020 on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.