GDPR roles are often copied before they are checked

GDPR roles are often copied before they are checked

Data protection clauses often start with a template assumption: one party is controller, the other is processor. Sometimes that is correct, but roles follow the factual allocation of decision-making. A controller determines the purposes and essential means of processing. A processor processes personal data on behalf of a controller and on that controller’s instructions. In some situations, parties may be independent controllers or joint controllers for part of the processing and controller-processor for another part.

The contract cannot simply choose the roles if the facts point elsewhere.

Wrong role allocation creates practical problems. If a party is called a processor but actually determines purposes, the processor clauses will not be enough. The wrong party may be made responsible for transparency notices, data subject requests, legal bases, retention periods, international transfers, security measures or breach notifications. Audit rights may be too broad for one activity and too narrow for another. Sub-processor wording may be irrelevant for processing that is not performed on behalf of the other party.

A GDPR schedule that does not match the service model can create false comfort, and become a problem immediately if there is a data incident or customer complaint.

Before signing the data protection wording, it is worth mapping the processing:

- What personal data is processed, for which purposes, and by whom?

- Who decides the purposes and essential means of each processing activity?

- Which activities are performed strictly on documented instructions, and which are not?

- Are there separate roles for different data flows, modules or service components?

- Who handles transparency, legal basis, data subject rights, retention and deletion?

- Are international transfers, subprocessors, security measures and breach notifications described accurately?

GDPR wording should follow the processing reality. If the roles are wrong, the rest of the schedule is built on the wrong foundation.