Regulation and data
Controller and processor
The controller is whoever decides what personal data are processed for and how; the processor is whoever processes them on the controller's behalf. In a residence, the centre is the controller of its residents' data, and the software supplier or the caterer that handles them for it is a processor.
Also known asdata controller · data processor · responsable y encargado del tratamiento
What tells them apart
The definitions are in art. 4 of the GDPR: the controller is whoever, alone or jointly with others, "determines the purposes and means of the processing" (4.7), and the processor is whoever "processes personal data on behalf of the controller" (4.8). The useful question is not who stores the data but who decides what is done with them. It is worth asking it too of the supplier that connects the centre's WhatsApp as a Tech Provider: what it processes the messages for, and on whose behalf.
| Controller | Processor | |
|---|---|---|
| What it decides | What the data are used for and how | Nothing on its own account: it follows the controller's documented instructions (art. 28.3.a) |
| In a centre | The colegio mayor or the residence operator | The management software, the caterer, the accountants |
| What it signs | Chooses a processor with guarantees and requires a contract (art. 28.1 and 28.3) | That contract, the DPA, and it engages no other processor without authorisation (art. 28.2) |
| Its record | That of its own processing (art. 30.1) | That of what it processes on behalf of each controller (art. 30.2) |
Worth knowing
The role is decided by what is done, not by what the contract says. Whoever appears as processor and uses the data for its own purposes becomes the controller of that processing (art. 28.10 of the GDPR and art. 33.2 of the LOPDGDD, Spain's data protection act). The same happens to a supplier that deals with residents in its own name without it being stated that it acts on the centre's behalf. The AEPD, the Spanish data protection authority, develops this in its guidelines for contracts between controllers and processors.
Sources
Related terms
- Tech ProviderA Tech Provider, in Meta's terminology, is a software provider that builds the WhatsApp Business Platform into its product and onboards its clients so they can use WhatsApp through it. It has to verify its business with Meta and pass Meta's review of its app.
- GDPRThe GDPR is Regulation (EU) 2016/679, the EU rule that governs the processing of personal data. It has applied directly since 25 May 2018, and in Spain the LOPDGDD completes it. It binds a colegio mayor, a private student residence and a coliving in exactly the same way.
- DPA (data processing agreement)A DPA (data processing agreement) is the contract that art. 28.3 of the GDPR requires between the controller and each processor: it sets out the subject matter, duration, nature and purpose of the processing, the type of data and of data subjects, and each party's obligations and rights.