A processor argues that EDPB guidance on controller and processor roles can be ignored because the written contract already looks clear. Which statement best reflects how that guidance should be used?

EDPB opinions and guidelines are interpretive aids that help analyse controller and processor roles alongside the GDPR text, even when a written contract seems clear. Processors who dismiss that guidance because the contract “looks clear” risk misclassifying responsibilities that turn on who determines purposes and means, not on cover-page labels alone. EDPB documents do not replace the GDPR whenever a clause is longer than one page. Guidance does not bind only the processor while ignoring controller-role analysis. Contracts alone do not define legal roles so completely that soft-law guidance has no interpretive value. Exam caveat: substance-over-label plus use of EDPB interpretive aids is the expected stance. Operational check: when reviewing a civic SaaS DPA, walk the EDPB role criteria against actual decision rights (who sets purposes, who can change essential means) and revise labels that conflict with the facts. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.