6

We are a charity that uses software to keep names and addresses of it's members. Email addresses and Emergency Contacts. We use a piece of software that is NOT cloud based. It is installed on the Secretaries pc. The software provider CANNOT see any data, access it, they do not store it.

Are they a Data Processor? Do we need a DPA? Once we download the software everything is on our own pc, encrypted, password protected etc. We store everything and enter all data ourselves

Improve this question

3 Answers 3

Reset to default
10

Art. 4 (8) of the GDPR defines what a data processor is:

A ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

As your software supplier does not process any data (no access, no storage, etc) they are not a processor. You therefore do not need a Data Processing Agreement.

Your charity is a controller according to the GDPR art.4 (7).

‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data [...]

As a controller, you are responsible for all the requirements stated in the GDPR.

Improve this answer
6
  • Can a controller also be a processor with respect to the same personal data by virtue of the fact that it itself processes data on its own behalf? I mean, obviously the trivial answer is "yes," but for the purpose of the GDPR, are there any responsibilities imposed on a "data processor" but not a "data controller" that could apply to such an entity?
    – phoog
    Commented Jul 3 at 11:04
  • @phoog you can have two departments in the same organisation that have those different roles.
    – Trish
    Commented Jul 3 at 11:08
  • 2
    @Trish I'm not asking about departments and roles. Besides, two departments of the same company are a single "legal person" in the eyes of the law. The question is whether it matters under the GDPR. What responsibilities of a data processor would apply in this case? Does a data processor have any responsibilities to a data subject that a data controller doesn't have? Does a data controller avoid these responsibilities by doing the processing itself?
    – phoog
    Commented Jul 3 at 11:30
  • 4
    @phoog a GDPR data processor can only exist separate from a controller because they act "on behalf of the controller". This delegation of processing activities is the relevant aspect, not the processing itself. There also has to be a contract between the two parties (see Art 28 GDPR), and you can't contract with yourself. The main responsibility of a processor is to only process data as instructed by the controller, but compared to controllers they have greatly simplified compliance otherwise (no privacy notices, no legal bases, no data subject requests, … – that's all the controller's job).
    – amon
    Commented Jul 3 at 19:45
  • 1
    @amon "because they act 'on behalf of the controller'": if that is the intended logic (which my subsequent research suggests is the case) then the definition is poorly worded,at least in its English version, because one can act on one's own behalf. Having to infer that this possibility is excluded by the contract requirement is unnecessary; it could have been avoided by adding a couple of words to the definition.
    – phoog
    Commented Jul 3 at 22:07
4

The software provider is not a data processor

To be a data processor, you'd need to process data. They don't. So they can't be a data processor.

The charity is a data processor & controller

Even if the database is offline, there's processing, collecting and managing Data going on by the charity or different branches of it. As such, they have to follow the whole GDPR and figure out if they are a controller or if they have controller and processor sub-branches. It's highly advised to get a GDPR specialist lawyer to figure out the requirements.

Improve this answer
3
  • 1
    @Trish a few minutes of superficial research suggests that under the GDPR definitions a data processor is specifically only a separate entity that processes data for a data controller and that any processing performed by the controller itself is governed by its obligations as a data controller. What leads you to conclude otherwise?
    – phoog
    Commented Jul 3 at 11:40
  • 1
    @phoog Some Companies contain nested, partially separate organizations that do act as data processors for the head company being the controller.
    – Trish
    Commented Jul 3 at 12:17
  • 2
    if it is a "separate organization" then it isn't the same legal person. So it's not the same entity being both controller and processor for the same data.
    – phoog
    Commented Jul 3 at 22:10
2

For example, a supplier of database or spreadsheet creation software, with which a buyer can create databases or spreadsheets on their own computer in which the buyer stores personal data. This supplier has no interest in the data, it is not given that data, it has no access to that data, it is not instructed to process that data, it makes no decisions about that data, the data's purpose or lawful basis.

This supplier is not a GDPR data processor with respect to that data.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .