Controller - Processor Assessment Tool

Make this test to determine wether you are a controller, processor or joint controller. The test is based on EDPB Guidelines 07/2020.

Section

Are you appointed as controller according to a legal act for the processing in question? (explicit legal competence)

yes

The legal act applies and you are the controller for that specific processing

Section

Is the processing necessary in order to carry out a task for which you are responsible according to a legal act? (implicit legal competence)

yes

You are the controller of the processing necessary to execute this task

Section

Do you decide?

the purpose or purposes that the data will be processed for
which personal data that shall be collected and processed
which categories of individuals that the processed data will refer to
whether the processed data shall be disclosed and to whom
for how long the personal data will be stored

yes

No, I carry out the processing on behalf of another party, in accordance with its instructions. I make decisions about certain non-essential means to be used (e.g., what IT systems or other technical means to use for the processing or details of the security measures based on the general security objectives set by the other party)

No, I carry out the processing on behalf of another party and solely in accordance with its instructions. I do not make any decisions as to purposes and means of the processing of my own

I don't know who decides on the purposes or means of the processing

You are the controller for this personal data processing (see below for assessment of joint control if other entities are involved)

You are a processor

Which of the following factors are more applicable to your case?

You obtain a benefit from, or have an interest in, the processing (other than the mere payment for services received from another controller)
You make decisions about the individuals concerned as part of or as a result of the processing (e.g. the data subjects are your employees)
The processing activities can be considered as naturally attached to the role or activities of your entity (e.g. due to traditional roles or professional expertise) which entails responsibilities from a data protection point of view
The processing refers to your relation with the data subjects as employees, customers, members etc.
You have complete autonomy in deciding how the personal data is processed
You have entrusted the processing of personal data to an external organisation to process the personal data on your behalf

You process the personal data for another party’s purposes and in accordance with its documented instructions - you do not have a purpose of your own for the processing.
Another party monitors your processing activities in order to ensure that you comply with instructions and terms of contract.
You do not pursue your own purpose in the processing other than your own business interest to provide services.
You have been engaged for carrying out specific processing activities by someone who in turn has been engaged to process data on another party’s behalf and on this party’s documented instructions (you are a sub- processor)

You are a controller

You are a processor

Is another party involved in the personal data processing in question?

yes

You are the sole controller and must decide on purposes and means of the processing

If you are human, leave this field blank.

Section

Section

Section

Related Resources:

Review of cybersecurity news in Ukraine, tendencies, and world events related to the First World Cyber War by U.S. Agency for International Development

Joined Cases C-511/18, C-512/18 and C-520/18

CASE OF BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM

Controller – Processor Assessment Tool

Section

Section

Section

Related Resources:

Review of cybersecurity news in Ukraine, tendencies, and world events related to the First World Cyber War by U.S. Agency for International Development

Joined Cases C-511/18, C-512/18 and C-520/18

CASE OF BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM