Under the GDPR, how do you decide whether a vendor is a controller, a processor or a joint controller?

## The three roles in the Regulation's text The GDPR assigns obligations by **role**, and every role is defined in the Regulation: | Role | Definition | Where | |---|---|---| | **Controller** | Determines the purposes and means of processing, alone or jointly with others | `Art. 4(7)` | | **Processor** | Processes personal data on behalf of the controller | `Art. 4(8)` | | **Joint controllers** | Two or more controllers that jointly determine purposes and means | `Art. 26(1)` | | **Third party** | Anyone other than the data subject, controller, processor and persons authorised under their direct authority | `Art. 4(10)` | A **recipient** (`Art. 4(9)`) is any body to which data are disclosed, whether a third party or not, so a processor is a recipient too. ## The test: who decides why, and who decides how Role allocation is a question of fact. Ask, for each distinct processing operation: - **Why is this processing happening, and for whose benefit?** The party that sets the purpose is a controller. - **Who decides the essentials of how?** Which data are collected, how long they are kept, who receives them. Deciding these is part of determining the means. - **Who merely decides technical details?** Choosing the database engine, the hosting region or the batch schedule while serving someone else's purpose does not, on its own, make a vendor a controller. - **Does the vendor have any use of the data of its own?** If not, and it follows instructions, it is a processor. The contract's label is evidence, not the answer. A contract calling a vendor "processor" while the vendor uses the data for its own ends does not make it one, and `Art. 28(10)` says a processor that determines purposes and means in breach of the Regulation *shall be considered to be a controller in respect of that processing*. ## Worked example: a payroll provider A company hires a payroll provider to compute its employees' salaries, withholdings and payslips. 1. **The client decides why**: pay employees and meet its payroll duties. It decides which employees and which data go in. 2. **The provider decides technical details**: its software, its servers, its calculation engine. 3. **The provider has no purpose of its own** for the employee data in this service. So the client is the controller and the provider is the processor for payroll processing, and an `Art. 28` contract must govern the relationship. The same provider is a controller for other processing, for example its own staff records or its own customer accounts. Roles are assigned *per processing operation*, not per company. ## Joint controllers When two parties **jointly determine** purposes and means, for instance two companies that design and run a shared customer programme together, each deciding what is collected and why, they are joint controllers. `Art. 26` then requires: - a **transparent arrangement** determining their respective responsibilities, in particular for data-subject rights and the Art. 13 and 14 information duties (`Art. 26(1)`), unless law already allocates them; - that the arrangement **duly reflects** their roles and that its **essence is made available** to data subjects (`Art. 26(2)`); - acceptance that a data subject **may exercise their rights against each** of the controllers, whatever the arrangement says (`Art. 26(3)`). Joint control does not require equal shares of responsibility; it requires joint determination. ## Why the label matters in practice The role decides which duties you carry: - **Controllers** carry the Regulation's core duties: the principles in `Art. 5`, a lawful basis, transparency, data-subject rights, records under `Art. 30(1)`, security under `Art. 32`, breach notification to the authority, and choosing processors that give sufficient guarantees (`Art. 28(1)`). - **Processors** carry their own direct duties: act only on documented instructions (`Art. 28(3)(a)`, `Art. 29`), keep records of processing carried out for controllers (`Art. 30(2)`), implement `Art. 32` security, and notify the controller *without undue delay* after becoming aware of a breach (`Art. 33(2)`). - **Liability** follows too: under `Art. 82(2)` a controller involved in processing is liable for damage caused by infringing processing, while a processor is liable only where it breached obligations aimed at processors or acted outside or contrary to lawful instructions. ## Common mistakes - Treating the party that **stores** the data as the controller. Storage is a means; it says nothing about purpose. - Assuming a vendor is a processor **because the contract says so**. - Believing a company has **one role overall**. It has a role per processing operation. - Thinking joint controllers can **route all rights requests to one party**. `Art. 26(3)` lets the data subject choose.