Does your online application process personal data for customers? You are generally a processor for the activities you carry out solely on their behalf. If you also use data for your own purposes, assess that processing separately. One business can have different roles under the GDPR.
How do you determine your role?
The central question is: who decides why personal data is processed and makes the key choices about it? The controller determines the purposes and means of processing. The processor carries out processing on that controller’s behalf. This follows from Article 4(7) and 4(8) GDPR.
These key choices include:
- whose personal data is processed;
- which data is needed;
- who gets access;
- how long the data is retained.
Technical implementation choices, such as the software used or specific security measures, may be left to the processor. Developing and technically managing the application therefore does not automatically make you a controller. A standardised service can also be a processing service, as the EDPB explains.
How does this work for an events application?
Suppose a business uses your application to manage registrations for a business event. It decides why participant data is needed and which participants to invite. Your application stores names and email addresses and sends confirmations on its behalf.
If you process this data solely in accordance with the arrangements with the organiser, you are a processor for that participant management. The organiser is the controller in this example.
You may simultaneously have a different role for your own customer administration. If you use the organiser’s contact details to manage the subscription and issue invoices, you are generally a controller for that administration. Assess each activity separately.
What changes if you want to use participant data yourself?
Do you want to independently send participants advertising for your platform? Or combine their data in your own database for commercial profiling? You are then determining your own purpose and are a controller for that use.
That does not mean the use is permitted. You cannot simply reuse data received as a processor for yourself. You must assess, among other things, the original arrangements, compatibility with the original purpose, an appropriate lawful basis and the information provided to individuals.
The French supervisory authority, CNIL, emphasises that a processor may not reuse data for its own purposes on its own initiative. It requires the original controller’s written authorisation for specifically assessed reuse. A blanket clause allowing any future reuse is insufficient.
Terms such as “analytics” or “product improvement” do not answer the question on their own. Specify which personal data you use, for what and for whose purposes.
When are you a joint controller?
This can arise when you and your customer jointly determine the purposes and essential means. For example, you run a joint campaign and decide together which participant data to collect and how to use it for that campaign.
Cooperation or commercial benefit alone is not enough. Using the same platform does not automatically make you joint controllers either. Converging decisions through which you jointly determine purposes and essential means can nevertheless lead to joint controllership, even without a formal joint decision.
That responsibility may be limited to a particular processing activity. It need not cover all activities of both businesses.
What agreements do you need?
A data processing agreement governs the relationship between a controller and a processor. Both parties must ensure that the agreement is in place and reflects the actual processing. It sets out what the processor may do with the data and the safeguards it must provide.
| Your role | What must you arrange? |
|---|---|
| Processor | Enter into a data processing agreement with your customer under Article 28 GDPR. Address instructions, security, assistance and deletion or return of data, among other matters. Engaging sub-processors brings additional conditions and contractual obligations. |
| Independent controller | Establish an appropriate lawful basis, clear information for individuals, retention periods and arrangements for exercising their rights. Do you engage processors? Assess their safeguards and enter into a data processing agreement with them under Article 28 GDPR. |
| Joint controller | Under Article 26 GDPR, set out how you divide responsibilities and make the essence of that arrangement available to individuals. If you engage a processor for that processing, the relationship with the processor must also be governed in accordance with Article 28 GDPR. |
An arrangement between joint controllers and a data processing agreement therefore govern different relationships. Both may be needed within the same service. The rules are in Articles 26 and 28 GDPR.
Is your customer itself a processor for another organisation? You may then be a sub-processor. This requires the original controller’s prior specific or general written authorisation. The applicable obligations must be passed on contractually. With general authorisation, the controller must be informed of changes in advance and have an opportunity to object.
Read our article on the data processing agreement too.
How do you approach this in practice?
- List your activities. Separate participant management, customer administration, your own marketing and analytics, for example.
- Describe the decisions for each activity. Record who determines the purpose and who decides on data, access and retention periods.
- Check how the service actually works. Include automated emails, default settings, exports and data that remains after a subscription ends.
- Record the correct role. State whether you are a processor, independent controller or joint controller for each activity.
- Align your documentation. Review your processing records, agreements and privacy notice. Reassess when you introduce new features or purposes.
A useful internal description might be: “We process participant data on behalf of the organiser for registrations and event communications. For our own customer administration, we determine the purposes and means ourselves.”
Use such a description only if it reflects your service.
Map your processing activities and the parties involved. Use GDPRWise to document your processes and align your privacy notice and agreements with them.