During the 51st plenary section which was held on the 7th of July 2021, the EDPB has adopted, after a public consultation, the final version of the guideline n. 7/2020 on concepts of data controller and processors pursuant to the GDPR.
The document is composed of two main parts: the first one has the purpose to clarify concepts of “data controller”; “subcontroller”; “processor” and “third party” and the second one describes consequences of the attributions of different roles in the personal data processing.
The guideline also introduces a diagram which provides additional practical settings and helps actors in understanding the above mentioned concepts.
After the public consultations ended in October 2020, the Board has kept in mind some comments and has prepared a new versión of the document, by introducing additional clarifications on questions like: the distinction between key ways/not essential (the so called “unessential/essential ways), the designation of joint controllers pursuant to the legislation, the situation inside a group of society, joint governance against “shared benefits”, cloud services and unbalance of power, costs of verifications, role of data protection officers and personal data protection breach.
eppb_guidelines_202007_controllerprocessor_final_enSOURCE: AUTORITA’ PER LA PROTEZIONE DEI DATI DELLA POLONIA – UODO