Who is responsible for what.
WHAT A CONTROLLER IS
The party deciding why and how personal data is processed.
WHAT A PROCESSOR IS
A party processing it on the controller's instructions.
WHY THE DISTINCTION MATTERS
Obligations differ substantially, and so does liability.
WHAT DETERMINES WHICH YOU ARE
What you actually decide, not what a contract calls you.
WHAT EXAMPLES LOOK LIKE
A business collecting customer details: controller
A hosting provider storing those details: processor
An accountant deciding how to handle your records: frequently a controller in their own right
WHAT A PROCESSOR MUST DO
Act only on documented instructions Keep the data secure Assist the controller with obligations Notify the controller of breaches Delete or return data at the end
WHAT A PROCESSOR MUST NOT DO
Use the data for its own purposes.
WHY THAT MATTERS
Doing so makes you a controller, with all the obligations.
WHAT JOINT CONTROLLERS ARE
Two parties deciding together.
WHAT THAT REQUIRES
An arrangement setting out who does what.
WHAT TO ESTABLISH FOR EVERY DATA FLOW
Which role you hold.
WHY
It determines what you must do, and what you must require of others.
WHAT TO RECORD
That determination, with the reasoning.
