HR uses a SaaS whistleblowing platform and is unsure who is controller. The vendor hosts the tool and acts only on documented instructions. How should roles typically be characterised?
Select an answer to reveal the explanation.
Short Explanation
Who decides “we run a hotline and why” is usually the controller—that’s the employer. The vendor that just hosts and follows instructions is typically the processor. Clear roles beat hoping the cloud logo settles it.
Full Explanation
Controller status turns on who determines purposes and means of processing. An employer that decides to operate a whistleblowing scheme and defines its scope is typically the controller. A software vendor that processes reports solely on the employer’s documented instructions is typically a processor and requires an Article 28 contract. Mislabeling roles undermines accountability and contractual safeguards.