A municipality outsources payroll hosting and assumes the host is automatically the controller. Which analysis follows GDPR role concepts?
Select an answer to reveal the explanation.
Short Explanation
Titles on a contract cover sheet are not magic. If the city still decides why payroll runs and how it should work, and the host just runs the servers on instructions, the city stays controller and the host is usually processor. Outsourcing hosting does not auto-promote the vendor to controller.
Full Explanation
GDPR roles depend on factual determination of purposes and means. A municipality that decides to process employee payroll data for employment administration typically remains controller, while a hosting provider acting only on documented instructions is ordinarily a processor (subject to the actual facts). Cloud hosting alone, vendor involvement, or logo prominence does not automatically reassign controllership contrary to decision-making reality.