Module 1 · Chapter 2

Controller or Processor: Who Decides About the Data

The controller decides why personal data is used. The processor uses it only for the controller. This chapter shows how to tell them apart, and when a supplier crosses the line.

≈ 6 min read 8-question test

In this chapter

  • The test that tells a controller from a processor
  • Which data Tennerby holds for Corrandale, and which is its own
  • What happens when a processor starts to decide for itself

2.1Controller or processor in one paragraph

The law gives each party that handles personal data a role. The controller decides why the data is used. The processor holds and uses it only for the controller.

Corrandale is the controller of its care workers’ data in the app, and Tennerby is its processor. The Data Processing Agreement between them says so. But a role follows what a party does. A supplier that starts to decide for itself changes its role.

Key point

Whoever decides why the data is used is the controller. A processor that starts to decide for itself becomes a controller too.

Also in this chapter

  1. The test: who decides why the data is used
  2. When a processor decides for itself
  3. Your job

Preview

The rest of this chapter opens with a free account. Every edition is free to read until 31 January. Open a free account by the end of that day and keep every edition published by then, for good. Open it from the edition home →