An online retailer decides which customer data to collect and why, and it uses a cloud provider that stores and processes that data only according to the retailer's documented instructions. Under the GDPR, how should these roles be classified?
Select an answer to reveal the explanation.
Short Explanation
Ask one question: who decides why and how? That's your controller, here the retailer. The provider just follows instructions, so it's the processor, no matter whose servers the data sits on. Don't let physical custody or shared access fool you into crowning the provider.
Full Explanation
The GDPR defines the controller as the party that, alone or jointly with others, determines the purposes and means of processing personal data, and the processor as the party that processes personal data on behalf of the controller. The retailer decides what data is collected and why, so it is the controller; the cloud provider stores and processes the data on documented instructions, so it is a processor. A written contract must bind the processor to act only on instructions, ensure confidentiality and security, use subprocessors only with authorization, assist the controller and delete or return data at the end of the service. Making the provider the controller because it chooses data center locations confuses non-essential technical means with determining purposes; processors can decide technical details without becoming controllers. Joint controllership requires both parties to jointly determine purposes and means, and mere access to data does not create it. Reversing the roles because the provider hosts the data again treats custody as control. Exam caveat: a provider becomes a controller for any processing it performs for its own purposes, such as using customer data to improve its products, which is why contracts restrict such use. Operational check: confirm a data processing agreement with the required terms is in place and that the records of processing list the provider as a processor.