We provide Software for a school, more specifically for the Students Councils there. Hence we don't sign our contract with the school, but with "the Head" of the Students Council, which is mostly just a teacher. The App allows members of the student council of one school to communicate and write articles about the student council's actions. The students that use the App have to accept to our Privacy Policy indiviually. As for now the teacher that signed the contract with us is the only one in that school-environment that is able to create new users, hence he is giving us the names (the data) of the students. Thinking GDPR through, that means he becomes a Data Controller and needs written approval of all the students (and if under 16, of the parents) so he is even allowed to create a user. Right?

But then if we change our system, so the teacher just needs to accept a request from the students to be a member of that student-council-app-environment. And the students themselves need to accept our privacy policy etc. so who is the Data Controller now? The teacher did sign the contract with us to use the App, but the users themselves entered their personal data. The teacher did decide that the App should be used, but didn't force anyone to do so. Is he still the Data Controller of the student data?

The question behind all that is of course if we need a DPA with that teacher, or if we can just offer a DPA for those who want it?

(Of course we know that we are also a Data Controller, because it is our App, that we provide that accually needs the data to work. And we have DPAs with all the Subprocessors we work with (exept Google and Apple, see my other question for the Push Tokens and DPAs)).

Of course I read the GDPR but I find the definition of Data Controller too vague to decide on my special case.

  • 2
    It's not an answer to your question, but it is a much perpetuated myth that you need consent under the GDPR. Consent is 1 out of 6 possible lawful bases (see Article 6). You can lawfully process data if you establish any of those (and provided that you comply with the rest of the GDPR). You only need consent if that is the only lawful basis.
    – JBentley
    Mar 13 at 13:02
  • I think your distinction between the teacher and the school is irrelevant, the teacher is just a representative of the school. The legal person you have a contract with is the school, not the individual teacher.
    – quarague
    Mar 14 at 16:13

2 Answers 2


Who are you doing business with?

Typically, a "student council" is typically not a legal entity - the way "the people at my last birthday party" is not a legal entity. You are signing an agreement with a person (the teacher), who is a legal entity, but it is unclear if they are acting on their own behalf or as an agent for somebody else, and if so, who that is. Are they an agent for the school? For each student who signs up? For an unincorporated partnership, that might be called the student council?

You need to get legal advice to tighten up your contract to make sure your interests are protected - there are likely people with access to your software that have no legal obligations to you at all.

Data controller or Data Processor?

A data controller determines the purposes and means of processing personal data. In other words, the data controller decides the how and why of a data processing operation.

In certain cases, the purposes and means of processing personal data, as well as the controller, may be determined by EU or Member State law.

When there are two or more data controllers who jointly determine the purpose and means of processing, they are considered joint controllers. They decide together to process personal data for a joint purpose. Joint controllership can take many forms and participation of the different controllers may be unequal. Joint controllers must therefore determine their respective responsibilities for compliance with the GDPR.

A processor acts under the instructions of the controller only, by processing personal data on behalf of the controller.

Based on your description, you are already a data controller. Probably a joint data controller with whoever you have your contract with. If they are acting in an official role (which you don't know since your contract is dangerously vague about who you have a contract with), then they need to decide for themselves how to act as a data controller.

What is your lawful basis?

You've stated that you need "written approval", which suggests that you haven't done your duty as a data controller and determined on what basis you are collecting personal information. Consent is a reason, but it seems you haven't considered the other, perhaps better, reasons why you are collecting the data.

Consent is difficult because it can be withdrawn, and you would have to delete every record of that person. This might mean that the student council records become incomplete or fragmented, which will likely annoy your customers. Perhaps contract or legitimate interests are better bases to rest your data collection.

Get yourself some proper legal advice now. Your company is just a time bomb waiting for enforcement action.

  • I think it's most likely that they're actually doing business with the school, or if it's a municipally-run school the municipality. And the teacher is just an agent -- the school might assign a different teacher each year as the advisor to the student council.
    – Barmar
    Apr 19 at 17:49

Does a "Data Controller" need to decide on behalf of others over their Data to become a Data Controller?

A data controller is an entity that "alone or jointly with others, determines the purposes and means of the processing of personal data.

Article 4(7):

‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

If the definitions in the GDPR are too vague/unhelpful then perhaps look at the controller, joint controller or processor checklists published by the UK's Information Commissioner's Office.

... The more boxes you tick, the more likely you are to fall within the relevant category.

Are we a controller?

☐ We decided to collect or process the personal data.

☐ We decided what the purpose or outcome of the processing was to be.

☐ We decided what personal data should be collected.

☐ We decided which individuals to collect personal data about.

☐ We obtain a commercial gain or other benefit from the processing, except for any payment for services from another controller.

☐ We are processing the personal data as a result of a contract between us and the data subject.

☐ The data subjects are our employees.

☐ We make decisions about the individuals concerned as part of or as a result of the processing.

☐ We exercise professional judgement in the processing of the personal data.

☐ We have a direct relationship with the data subjects.

☐ We have complete autonomy as to how the personal data is processed.

☐ We have appointed the processors to process the personal data on our behalf.

See the rest of the page for Are we a joint controller? and Are we a processor? checklists.

An entity deciding to collect/process, deciding the purpose of collection/processing, deciding what to collect, is an entity that is a controller.

Not the answer you're looking for? Browse other questions tagged .