Data Processor vs Data Controller

[rfakes]

At what point does someone stop being a data processor and becomes a data controller?

 

I.e if a company provides a cloud backup service, and you as a data controller make use of it and put your data on their server, are they a processor or a controller?

[djrscally]

At what point does someone stop being a data processor and becomes a data controller?

 

I.e if a company provides a cloud backup service, and you as a data controller make use of it and put your data on their server, are they a processor or a controller?

 

Broadly speaking, they're a processor.

 

The basic distinction is decision making authority over the data. If they can decide to process the data in a certain way without your input, then they are a controller of that data. As the ICO says:

 

• A controller determines the purposes and means of processing personal data.
  
• A processor is responsible for processing personal data on behalf of a controller.
  

[GrumbleDook]

An absolutely fantastic resource has been produced on this ...

 

https://missinfogeek.net/whos-in-control/

[rfakes]

Thanks both. So in this instance, because all they are doing is storing the data, and have no due right or responsibility to process it in anyway, they are a processor? and we as the controller have to be satisfied with their policies of controlling physical / remote access to that server (including their staff)?

[GrumbleDook]

Thanks both. So in this instance, because all they are doing is storing the data, and have no due right or responsibility to process it in anyway, they are a processor? and we as the controller have to be satisfied with their policies of controlling physical / remote access to that server (including their staff)?

 

Pretty much covers it.