HR uses a SaaS whistleblowing platform and is unsure who is controller. The vendor hosts the tool and acts only on documented instructions. How should roles typically be characterised?
Select an answer to reveal the explanation.
Short Explanation
Who decides “we run a hotline and why” is usually the controller—that’s the employer. The vendor that just hosts and follows instructions is typically the processor. Clear roles beat hoping the cloud logo settles it.
Full Explanation
Where HR uses a SaaS whistleblowing platform and the vendor hosts the tool acting only on documented instructions, roles typically cast the employer that determines purposes of the whistleblowing scheme as controller, while the vendor processing on instructions is typically a processor. Clear roles keep accountability with the organisation that decided to run the civic integrity channel. Saying the SaaS vendor is always sole controller because it wrote the software fails—software authorship does not automatically assign purposes of the employer’s hotline. Claiming everyone who can log into the platform is a joint controller by default fails by over-expanding joint controllership to mere authorised users. Asserting role labels do not matter if a DPA was never signed fails: roles matter legally, and missing Article 28 terms is itself a compliance gap. Exam caveat: factual influence over purposes and means can sometimes create joint controllership, but instruction-bound hosting of an employer-defined scheme is the classic processor pattern. Operational check: execute an Article 28 contract, document the employer as controller in notices and RoPA, limit vendor use of reports to instruction-bound hosting/support, and audit access controls on the platform.