Processing and Roles

Key Concept 3 — Processing and Roles

Almost everything you do with personal data is processing — and someone is responsible for it.

Processing covers the whole lifecycle: collecting, recording, storing, using, sharing, changing and deleting data, whether on paper or in IT systems. Every processing activity has clear roles.

The roles

Controller: decides why and how personal data is processed, and is accountable for compliance. Example: your company for its own customer and employee data.
Processor: processes personal data on behalf of and on the instructions of the controller. Example: a payroll provider, a cloud or IT service provider. A written contract is needed.
Data subject: the person the data is about — customers, employees, applicants, suppliers' contacts, website visitors.
Joint controllers: two organisations that decide the purposes together, e.g. a joint marketing campaign. They must agree who does what.
Tip: the role depends on the activity, not on the company. A provider can be processor for your data and controller for its own.

Local terms and scope

Spain

Responsable del tratamiento (controller)
Encargado del tratamiento (processor)
Interesado (data subject)

The GDPR applies to organisations established in the EU and to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour. It protects natural persons only.