CIPPE Module 3 - Controllers and Processors

Question 1

What are the four key roles in GDPR?

Answer 1

1. Data Subject - natural person about whom data is collected.
2. Data Controller - determines what/how data is collected.
3. Data Processor - has no autonomy over the data; they only do what the controller tells them to do.
4. Supervisory Authority

Question 2

Who is a data controller?

Answer 2

A natural or legal person, public authority, agency, which alone or jointly with others determines the purpose and means of processing personal data.

Question 3

Who is a data processor?

Answer 3

A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Question 4

What are the obligations of the data processor?

Answer 4

1. Process personal data only on the documented instructions of the data controller, including with regards to data transfers outside the EEA
2. Only authorized persons
3. Implement security measures
4. Sub-processor obligations
5. Assist the controller with their obligations
6. Delete/return data to the controller at the end
7. Help controller demonstrate compliance.