A municipality outsources payroll hosting and assumes the host is automatically the controller. Which analysis follows GDPR role concepts?
Select an answer to reveal the explanation.
Short Explanation
Titles on a contract cover sheet are not magic. If the city still decides why payroll runs and how it should work, and the host just runs the servers on instructions, the city stays controller and the host is usually processor. Outsourcing hosting does not auto-promote the vendor to controller.
Full Explanation
Classification follows who determines purposes and means of the payroll processing; a host that only provides hosting on the municipality’s documented instructions is typically a processor, not automatically the controller because of a cover-page title. Outsourcing payroll hosting does not flip controllership by magic. Any cloud provider is not always the controller for all customer HR data by operation of law. Municipalities do not cease being controllers once any vendor touch is involved. Controller status is not assigned solely by whose logo appears largest in the privacy notice. Exam caveat: hosting ≠ automatic controllership; decision-making authority controls. Operational check: keep the municipality as controller for employee payroll purposes, execute an Article 28 DPA with the host, and verify the host cannot reuse payroll data for its own purposes. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis.