Controller or processor: when a data processing agreement is needed and what Article 28 requires
A cloud service, a payroll provider and an AI tool process personal data for you. How the role is decided, what the agreement must contain and who answers for a subcontractor.
· 5 min read
In brief
Every organisation uses services that process its personal data: email, payroll, a customer register in the cloud, now also AI tools. The GDPR divides the parties into the controller, which determines the purposes and means of processing, and the processor, which processes data on the controller's behalf. Article 28 says the controller may use only processors that provide sufficient guarantees, and that the processing must be governed by a written contract with prescribed content. Deciding the role is the first question, and it decides who answers for what when something goes wrong.
Whoever decides is the controller
The role does not come from the title of a contract but from the facts. The controller is whoever decides why personal data is processed and by what means. A municipality that moves its client data into a vendor's system is still the controller: it decided the purpose of the processing, and the vendor carries it out. The vendor is a processor as long as it does only what the municipality has instructed.
Article 28(10) draws the line: if a processor infringes the regulation by determining the purposes and means of processing, it is considered a controller in respect of that processing. A cloud service that uses its customers' data to develop its own product without authority from the contract is no longer a processor. This is why an AI service's terms of use are read before personal data is entered into it: a service allowed to train its model on inputs is not a processor but a recipient, and giving it the data is a disclosure. That is covered in An AI use policy for the workplace.
Article 24 recalls where the responsibility ultimately lies: the controller must implement technical and organisational measures to ensure and to be able to demonstrate that processing complies with the regulation, and review them where necessary. Choosing a processor is one of those measures.
What Article 28 requires of the contract
Under paragraph 1 the controller shall use only processors providing sufficient guarantees to implement appropriate measures so that processing meets the regulation's requirements and protects the data subject's rights. Paragraph 3 requires that processing is governed by a contract or other legal act binding the processor, and lists what it must contain.
| Content of the contract | Provision |
|---|---|
| Subject matter and duration, nature and purpose of processing, type of personal data and categories of data subjects, the controller's obligations and rights | 28(3) opening |
| Processing only on the controller's documented instructions, including transfers to third countries | 28(3)(a) |
| Persons authorised to process have committed to confidentiality | 28(3)(b) |
| All security measures required by Article 32 | 28(3)(c) |
| Conditions for engaging sub-processors | 28(3)(d) |
| Assistance in responding to data subjects' requests | 28(3)(e) |
| Assistance with security, breach notification and impact assessment obligations | 28(3)(f) |
| Deletion or return of data at the end of the service, including copies | 28(3)(g) |
| Information to demonstrate compliance and allowing audits | 28(3)(h) |
Under paragraph 9 the contract must be in writing, including in electronic form. A data processing addendum in the vendor's standard terms satisfies this if its content covers the list. Paragraphs 6 to 8 allow the use of standard contractual clauses adopted by the Commission or a supervisory authority, and under paragraph 5 adherence to approved codes of conduct or certification may be used as an element to demonstrate sufficient guarantees.
The continuation of point (h) also obliges the processor to inform the controller immediately if it considers that an instruction infringes data protection law. A processor may not follow an unlawful instruction in silence.
Subcontractors and liability along the chain
Under paragraph 2 the processor shall not engage another processor without the controller's prior specific or general written authorisation. In the case of general authorisation the processor must inform the controller of intended changes and give it the opportunity to object. In practice this is the vendor's sub-processor list and a notice of changes, and the controller's job is to read the notices.
Paragraph 4 keeps the chain intact: the sub-processor is bound by the same data protection obligations as the first processor, and where the sub-processor fails to fulfil them, the initial processor remains fully liable to the controller. The controller therefore need not contract with every sub-processor, but it must know who they are and where they process the data. How CoreSkills itself discloses its sub-processors and data locations is described in Where your data is.
Joint controllers
Article 26 concerns the situation where two or more controllers jointly determine the purposes and means of processing. They are joint controllers and must determine, in a transparent arrangement, their respective responsibilities, in particular for the exercise of data subjects' rights and information duties, and may designate a contact point. The essence of the arrangement must be made available to data subjects, and a data subject may exercise their rights against each controller regardless of its terms.
In the public sector this is common: a shared service between a municipality and a wellbeing services county, a joint authority's system or a register shared by several authorities. The mistake is to assume the other party is a processor when in fact it decides on the processing jointly.
What this requires of each role
Our skills catalogue describes controller responsibilities and processing agreements at four levels. Everyone knows that the organisation answers for the data it gives a vendor. A supervisor recognises when a new tool processes personal data and does not put it into use before the role and the contract have been checked. Whoever is responsible for procurement assesses the role, requires the Article 28 content in the contract and reads the sub-processor notices. The data protection officer resolves the edge cases, joint controllership and the situation where a vendor has started using data for its own purposes.
The data protection officer's role as a whole is described in When must a data protection officer be appointed and what must they know?. When a data breach happens at the processor, Article 28(3)(f) and Article 33(2) oblige it to notify the controller without undue delay; what happens next is covered in Personal data breach.
Frequently asked questions
What distinguishes a controller from a processor?
The controller determines the purposes and means of processing: why personal data is processed and how. The processor processes data on the controller's behalf and on its instructions. A service that starts using the data for its own purposes, such as training a model or its own marketing, exceeds the processor's role, and under Article 28(10) it is considered a controller in respect of that processing.
What must a processing agreement contain?
The subject matter and duration of the processing, its nature and purpose, the types of personal data and categories of data subjects, and the controller's obligations and rights. The processor must also commit to processing only on documented instructions, ensuring its staff's confidentiality, implementing the security measures of Article 32, using sub-processors only with authorisation, assisting with data subjects' rights and data breaches, deleting or returning the data at the end of the service and allowing audits. The agreement must be in writing; electronic form is enough.
May a processor use a subcontractor?
Only with the controller's prior specific or general written authorisation. In the case of general authorisation the processor must inform the controller of intended changes to sub-processors so that the controller can object. The sub-processor is bound by the same data protection obligations as the processor, and if it fails to meet them, the initial processor remains fully liable to the controller.
What is a joint controller?
Two or more controllers that jointly determine the purposes and means of processing, for example a municipality and a wellbeing services county in a shared service. They must agree transparently on their respective responsibilities, in particular for data subjects' rights and information duties, and the essence of the arrangement must be available to data subjects. A data subject may exercise their rights against either controller regardless of the arrangement.