A vendor hosts the city’s constituent CRM and processes resident records only on the city’s documented instructions. How should controller versus processor roles be assigned?
Select an answer to reveal the explanation.
Short Explanation
Who decides why the data exists? That’s usually the city—the controller. The CRM host that just follows instructions is typically the processor, even if the servers aren’t in city hall.
Full Explanation
In privacy governance, the controller determines purposes and essential means of processing, while the processor processes personal data on the controller’s behalf. A municipality that defines why constituent CRM data is collected and how it is used typically remains the controller; a hosting vendor following documented instructions is commonly a processor. Correct role assignment drives contracts, instructions, and accountability.