Processing and Roles

Key Concept 3 — Processing and Roles

Almost everything you do with personal data is processing — and someone is responsible for it.

Processing covers the whole lifecycle: collecting, recording, storing, using, sharing, changing and deleting data, whether on paper or in IT systems. Every processing activity has clear roles.

The roles

Controller: decides why and how personal data is processed, and is accountable for compliance. Example: your company for its own customer and employee data.
Processor: processes personal data on behalf of and on the instructions of the controller. Example: a payroll provider, a cloud or IT service provider. A written contract is needed.
Data subject: the person the data is about — customers, employees, applicants, suppliers' contacts, website visitors.
Joint controllers: two organisations that decide the purposes together, e.g. a joint marketing campaign. They must agree who does what.
Tip: the role depends on the activity, not on the company. A provider can be processor for your data and controller for its own.

Local terms and scope

Chile

Responsable (controller)
Encargado / mandatario (processor)
Titular (data subject)

Law 21.719 applies to controllers and processors established in Chile, and to those abroad that offer goods or services to, or monitor, people in Chile.