A retailer uses a cloud payroll provider to pay its employees. The retailer decides what employee data is collected and why it is processed; the provider processes that data only according to the retailer's instructions. Which roles do the two organizations hold?
Select an answer to reveal the explanation.
Short Explanation
Ask yourself one question: who decides why and how the data is used? If you can name that party, you've found the controller, here the retailer, and whoever just follows those instructions is the processor. Don't be tricked by who physically holds the data; the provider runs the servers, but it isn't calling the shots.
Full Explanation
Privacy frameworks distinguish roles by decision-making authority, not by who stores the data. The controller determines the purposes and means of processing personal data, and therefore carries primary accountability for lawful processing, notices, and individuals' rights. The processor processes personal data on the controller's behalf and only on its documented instructions. The retailer decides which employee data is collected and why, so it is the controller; the payroll provider acts on the retailer's instructions, so it is the processor, and any provider it engages in turn would be a subprocessor. Reversing the roles because the provider runs the systems confuses technical custody with decision-making authority. Joint controllership applies only when two organizations jointly determine purposes and means; here the provider has no say in why the data is processed, so handling the data alone does not make it a joint controller. Data custodian and data owner are internal data governance roles: the owner is accountable for a data set and the custodian implements its protection day to day; they do not describe the legal relationship between two separate organizations. Exam caveat: a processor that starts using data for its own purposes may become a controller for that processing. Operational check: confirm a data processing agreement exists that limits the provider to the retailer's instructions and lists permitted subprocessors.