YTYK You think you know

Card 4 of 18 Controller and processor ●○○ Foundational

The controller is whoever decides why

The controller determines the purposes and means of processing; the processor acts only on the controller's documented instructions. The role follows the decisions, not the label in the contract.

Why it is like this

Duties had to attach to whoever actually holds the steering wheel, otherwise they could be contracted away to the smallest party in the chain.

Not to be confused with

A matter of who holds the data, or who the contract names. A supplier that decides for its own purposes what to do with the data is a controller for that processing, whatever the data processing agreement says.

In practice

A payroll bureau following your instructions is a processor. The same bureau using the payroll data to build a salary benchmarking product is a controller for that use.

Source: Regulation (EU) 2016/679 (GDPR) — Article 4(7) and 4(8). Read on .

Predict Check yourself

A SaaS vendor is named "processor" in a signed DPA, but it also mines customer data to train its own product models. What is it, for that use?

  1. A controller for that processing — it decided the purpose, so the DPA's label does not apply to it.
  2. Still a processor, because the DPA defines the relationship.
  3. A joint controller with the customer by default.
  4. A third party, outside the regulation.
Show the answer

A controller for that processing — it decided the purpose, so the DPA's label does not apply to it.

Roles are factual. Deciding a new purpose makes you a controller for it, with all the duties that follow — including having your own lawful basis.