prudenceby Runciter

Governance and inventory

Determine the role held for a processing relationship

Record the role each entity performs for a specific processing activity, so one organisation may hold different roles for different activities.

A logistics supplier might process customer addresses as a processor for one activity and, in a separate arrangement, decide its own purposes for a loyalty scheme it runs jointly with the retailer. Prudence records the role by relationship, not by entity, because the same organisation can sit on either side of the line.

This matters most where two organisations jointly decide the purpose and means of a processing operation. Getting the role wrong here misstates who owes which obligation under Articles 26 to 28.

The proof is that opening any activity shows, without ambiguity, which party is the controller, which are processors, and which merely receive data.

Regulation
Articles 4(7) to 4(10), 26 and 28
Registers
Entity · Processing activity · Agreement · Privacy notice
The processing activities register, where a relationship is opened.
The processing activities register, where a relationship is opened.

The steps

  1. 01Open the Processing activities register and select the activity.
  2. 02Go to the Context tab.
  3. 03In the Linked records band, use "Link a record" to attach the controller.
  4. 04Repeat to attach each processor, then each recipient, choosing the correct role each time it asks.
  5. 05Where two controllers determine the purpose together, link both and use "Link a record" a further time to attach the joint controller arrangement.
  6. 06Check the Context tab reads back every party with the role you assigned.
The Context tab, where controllers, processors and recipients are linked with their roles.
The Context tab, where controllers, processors and recipients are linked with their roles.

Accepted when

  • The register of processing states the role of every party named on the activity.
  • A joint controller with no arrangement document is reported as a gap.

Documents that carry the evidence

JCA · Joint controller arrangement
Allocates responsibilities between joint controllers, names the contact point and states the essence of the arrangement made available to data subjects. Article 26.
DPA · Data processing agreement
The processor contract, with the instructions, confidentiality, security, subprocessing, assistance, return and audit terms Article 28(3) requires.

These templates are issued when the register opens, so the document exists before the record that cites it.