Conformally: Controller - Processor Assessment Tool (draft)

Make this test to determine wether you are a controller, processor or joint controller. The test is based on EDPB Guidelines 07/2020.


Are you appointed as controller according to a legal act for the processing in question? (explicit legal competence)

The legal act applies and you are the controller for that specific processing


Is the processing necessary in order to carry out a task for which you are responsible according to a legal act? (implicit legal competence)

You are the controller of the processing necessary to execute this task


Do you decide?

  • the purpose or purposes that the data will be processed for
  • which personal data that shall be collected and processed
  • which categories of individuals that the processed data will refer to
  • whether the processed data shall be disclosed and to whom
  • for how long the personal data will be stored

You are the controller for this personal data processing (see below for assessment of joint control if other entities are involved)

You are a processor

Which of the following factors are more applicable to your case?

You are a controller

You are a processor

Is another party involved in the personal data processing in question?
You are the sole controller and must decide on purposes and means of the processing