Guidelines 07/2020 on the concepts of controller and processor in the GDPR

• Jurisdiction: European Union
• Date: 07 July 2021
• Year: 2021
• Type of Document: Guidance

Adopted - After public consultation 1

Guidelines 07/2020 on the concepts of controller and

processor in the GDPR

Version 2.1

Adopted on 07 July 2021

Adopted - After public consultation 2

Version history

Version 2.1

20 September 2022

Minor corrections

Version 2.0

7 July 2021

Adoption of the Guidelines after public consultation

Version 1.0

2 September 2020

Adoption of the Guidelines for public consultation

Adopted - After public consultation 3

EXECUTIVE SUMMARY

The concepts of controller, joint controller and processor play a crucial role in the application of the

General Data Protection Regulation 2016/679 (GDPR), since they determine who shall be responsible

for compliance with different data protection rules, and how data subjects can exercise their rights in

practice. The precise meaning of these concepts and the criteria for their correct interpretation must

be sufficiently clear and consistent throughout the European Economic Area (EEA).

The concepts of control ler, joint controller and p rocessor are functional co ncepts in th at they aim to

allocate responsibilities according to the actual roles of the parties and autonomous concepts in the

sense that they should be interpreted mainly according to EU data protection law.

Controller

In principle, there is no limitation as to the type of entity that may assume the role of a controller but

in practice it is usually the organisation as such, and not an individual within the organisation (such as

the CEO, an employee or a member of the board), that acts as a controller.

A controller is a body that decides certain key elements of the processing. Controllership may be

defined by law or may stem from an an alysis of the factu al elements or ci rcumstances of the c ase.

Certain processing activities can be seen as naturally attached to the role of an entity (an employer to

employees, a publisher to subscribers or an association to its members). In many cases, the terms of

a contract can help identify the controller, although they are not decisive in all circumstances.

A controller determines the purposes and means of the processing, i.e. the why and ho w of the

processing. The controller must decide on both purposes and means. However, some more practical

aspects of implementation (“non-essential means”) can be left to the processor. It is not necessary

that the controller actually has access to the data that is being processed to be qualified as a controller.

Joint controllers

The qualification as joint controllers may arise where more than one actor is involved in the processing.

The GDPR introduces specific rules for joint controllers and sets a framework to govern their

relationship. The overarching criterion for joint controllership to exist is the joint participation of two

or more entities in the determination of the purposes and means of a processing operation. Joint

participation can take the form of a common decisi on taken by two or mor e entities or res ult from

converging decisions by two or more entities, where the decisions complement each other and are

necessary for the processing to take place in such a manner that they have a tangible impact on the

determination of the purposes and means of the processing. An important criterion is that the

processing would not be possible without both parties’ participation in the sense that the processing

by each party is inseparable, i.e. inextricably linked. The joint participation needs to include the

determination of purposes on the one hand and the determination of means on the other hand.

Processor

A processor is a natural or legal person, public authority, agency or another body, which processes

personal data on behalf of the controller. Two basic conditions for qualifying as processor exist: that it

is a separate entity i n relation to the contro ller and that it process es personal data on the controller’s

behalf.

The processor must not process the data otherwise than according to the controller’s instructions. The

controller’s instructions may still leave a certain degree of discretion about how to best serve the