Processing on behalf of a controller takes place when a company or another organisation processes personal data on behalf of a controller. The processor generally acts in accordance with the controller’s documented instructions and does not independently determine the purposes of the processing. Under Article 28 GDPR, the parties must govern their relationship by means of a data processing agreement (DPA) or another appropriate legal instrument. Typical examples include external IT service providers and cloud service providers.
When does processing on behalf of a controller take place?
Processing on behalf of a controller takes place when a service provider processes personal data for a controller and is subject to the controller’s instructions regarding the purposes of the processing.
Under Article 4(7) GDPR, the controller determines the purposes and essential means of the processing. Under Article 4(8) GDPR, the processor processes personal data on behalf of the controller. The service provider may independently determine certain technical and organisational details without automatically becoming a controller as a result.
Typical examples include:
- Storing personal data with a cloud service provider
- Hosting a website that involves the processing of personal data
- Outsourcing payroll processing to a service provider acting under the controller’s instructions
- External destruction of files and data storage media
- Operating a customer management system through an external IT service provider
Not every engagement of an external company automatically constitutes processing on behalf of a controller. The decisive factor is who determines the purposes and essential means of the specific data processing activity.
When is a data processing agreement required?
Where personal data is processed by a processor, Article 28(3) GDPR requires a data processing agreement (DPA) or another appropriate legal instrument.
In particular, the agreement must set out the following:
- The subject matter, duration, nature and purpose of the processing
- The categories of data subjects and types of personal data
- The rights and obligations of the controller
- Processing of personal data on documented instructions
- Confidentiality and technical and organisational security measures
- The conditions for engaging further processors
- Assistance with data subject rights and other data protection obligations
- The return or deletion of personal data upon completion of the processing
- Evidence of compliance with the obligations and the facilitation of audits and inspections
Under Article 28(9) GDPR, the agreement may be concluded in writing or in electronic form.
A DPA does not replace the legal basis for the underlying data processing. The controller must ensure that the processing is lawful, in particular in accordance with Article 6 GDPR.
What obligations do controllers and processors have?
Under Article 28(1) GDPR, a controller may only engage processors that provide sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of the GDPR.
Before engaging a service provider, the controller must therefore assess whether the provider implements appropriate technical and organisational measures to protect personal data. The selection process and the necessary checks must be documented in a traceable manner.
In particular, the processor must:
- Process personal data only on documented instructions, as a general rule
- Ensure that persons authorised to process personal data are bound by confidentiality obligations
- Implement appropriate security measures in accordance with Article 32 GDPR
- Assist the controller in fulfilling certain data protection obligations
- Notify the controller of personal data breaches without undue delay
- Provide the contractually agreed evidence of compliance and facilitate audits and inspections
These obligations arise in particular from Articles 28 and 32 to 33 GDPR.
May processors engage further service providers?
Under Article 28(2) GDPR, a processor may only engage further processors, known as sub-processors, with the controller’s prior specific or general written authorisation.
Where general authorisation has been granted, the processor must inform the controller of any intended changes. This gives the controller the opportunity to object to the proposed change.
Under Article 28(4) GDPR, the same data protection obligations as those agreed between the controller and the original processor must, in principle, be imposed on the sub-processor.
If personal data is transferred to a third country outside the European Economic Area in the context of processing on behalf of a controller, the requirements of Articles 44 et seq. GDPR must also be met.
Practical example: When does a company need a DPA?
An online retailer engages an external IT service provider to operate its customer management system. The service provider stores and backs up personal customer data on its servers.
The online retailer determines the purposes for which the data is processed. The service provider is responsible for the technical operation of the system and processes the data in accordance with the agreed instructions.
In this case, processing on behalf of a controller takes place. Before processing begins, the parties must conclude a DPA in accordance with Article 28(3) GDPR or govern the processing through another appropriate legal instrument.
The online retailer must also check whether the service provider ensures adequate security measures. If the provider engages further service providers, the requirements applicable to sub-processors must be observed.
legal data assessment: Before engaging external service providers, companies should assess whether the arrangement constitutes processing on behalf of a controller. A DPA alone is not sufficient: careful selection of the service provider, appropriate security measures and actual compliance with the contractual arrangements are also essential. Companies should pay particular attention to potential sub-processors and transfers of personal data to third countries, especially when using cloud services.
Legal basis
Articles 4(7) and 4(8), 6, 28, 32, 33 and 44 et seq. GDPR.
Frequently asked questions about processing on behalf of a controller
What is the difference between a controller and a processor?
The controller determines the purposes and essential means of processing personal data. The processor processes that data on behalf of the controller and, as a general rule, in accordance with the controller’s documented instructions.
Is a data processing agreement always required?
A DPA or another appropriate legal instrument is required where processing on behalf of a controller within the meaning of Article 28 GDPR takes place. However, not every business relationship with an external service provider constitutes such processing.
Does a DPA have to be concluded in writing?
Yes. Under Article 28(9) GDPR, the agreement or other legal instrument must be in writing. Electronic form is expressly permitted.
Who is liable for data protection infringements by a processor?
Both controllers and processors may be liable for damages under Article 82 GDPR, subject to the conditions set out in that provision. A processor is liable in particular where it breaches obligations specifically applicable to processors or acts contrary to the controller’s lawful instructions.
Is processing on behalf of a controller permitted with service providers outside the EU?
Yes, provided that the requirements for processing on behalf of a controller and the conditions for international data transfers under Articles 44 et seq. GDPR are met. These may include an adequacy decision or appropriate safeguards.
Related terms.
Controller The controller is the natural or legal person, public authority or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Art. 4(7) GDPR Technical and organisational measures (TOMs) Technical and organisational measures are the specific precautions a company takes to protect personal data. Art. 32 GDPR Cloud computing Cloud computing refers to the provision of IT services, such as storage space, computing power or software, over a network, particularly the internet. This enables companies to use IT resources flexibly without having to operate the entire technical infrastructure themselves. Where personal data is processed in this context, the requirements of the General Data Protection Regulation (GDPR) must be complied with. 