A product owner claims that after adopting enterprise SaaS for EU customer CRM, only the cloud provider is the controller and the company has no further GDPR role. What is the usual correct framing?
Select an answer to reveal the explanation.
Short Explanation
Renting Salesforce-style CRM does not mean you tossed the controller hat onto the provider. You still decide why customer data are processed; they mostly host and run the tooling as processor. Shared security is not shared-away accountability.
Full Explanation
A product owner claiming that after adopting enterprise SaaS for EU customer CRM only the cloud provider is the controller—and the company has no further GDPR role—usually has the framing backwards: in typical SaaS CRM, the customer remains controller for its customer-data purposes while the provider often acts as processor—accountability does not vanish into the cloud. Renting the tooling does not toss the controller hat onto the hyperscaler. Saying SaaS customers never determine purposes of CRM processing fails ordinary facts. Claiming moving to SaaS automatically makes the customer a processor for its own client database fails role logic. Asserting shared security responsibility means GDPR controller duties transfer entirely to the hyperscaler fails—shared security is not shared-away accountability. Exam caveat: edge cases can involve joint controllership if the provider determines purposes for its own ends, but classic customer-content CRM remains customer-as-controller. Operational check: sign Article 28 terms, keep RoPA and notices naming the organisation as controller, configure access and retention inside the tenant, and train staff that SaaS ≠ outsourced controllership. In public-interest terms, documenting the lawful analysis, assigning owners, and retaining evidence of how individuals were protected is how organisations demonstrate accountability when supervisory questions arrive.