Processing and Roles

Key Concept 3 — Processing and Roles

Almost everything you do with personal data is processing — and someone is responsible for it.

Processing covers the whole lifecycle: collecting, recording, storing, using, sharing, changing and deleting data, whether on paper or in IT systems. Every processing activity has clear roles.

The roles

Controller: decides why and how personal data is processed, and is accountable for compliance. Example: your company for its own customer and employee data.
Processor: processes personal data on behalf of and on the instructions of the controller. Example: a payroll provider, a cloud or IT service provider. A written contract is needed.
Data subject: the person the data is about — customers, employees, applicants, suppliers' contacts, website visitors.
Joint controllers: two organisations that decide the purposes together, e.g. a joint marketing campaign. They must agree who does what.
Tip: the role depends on the activity, not on the company. A provider can be processor for your data and controller for its own.

Local terms and scope

Colombia

Responsable del tratamiento (controller)
Encargado del tratamiento (processor)
Titular (data subject)

Law 1581 applies to personal data in databases processed in Colombia, and to processing abroad where Colombian law applies under international treaties. It protects natural persons.