Key Concept 3 — Processing and Roles

Almost everything you do with personal data is processing — and someone is responsible for it.

Processing covers the whole lifecycle: collecting, recording, storing, using, sharing, changing and deleting data, whether on paper or in IT systems. Every processing activity has clear roles.

The roles

  • Controller: decides why and how personal data is processed, and is accountable for compliance. Example: your company for its own customer and employee data.
  • Processor: processes personal data on behalf of and on the instructions of the controller. Example: a payroll provider, a cloud or IT service provider. A written contract is needed.
  • Data subject: the person the data is about — customers, employees, applicants, suppliers' contacts, website visitors.
  • Joint controllers: two organisations that decide the purposes together, e.g. a joint marketing campaign. They must agree who does what.
  • Tip: the role depends on the activity, not on the company. A provider can be processor for your data and controller for its own.

Local terms and scope

Mexico
  • Responsable (controller)
  • Encargado (processor)
  • Titular (data subject)

The LFPDPPP applies to private individuals and companies that process personal data. Public bodies are covered by a separate general law.

ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Mexico Slide 4 of 10