Person A is an employee of company B, which in turn is a customer of a SaaS platform from company C. Both companies are within the EU.

The B company uses the software to keep track of its customers, making the B company the data controller of that data. The C company is then obviously the data processor.

As a user of the software, person A is providing data about herself. Under the GDPR, who is the data controller of that data? Is it her employer, company B, or is it the SaaS provider company C?

  • For what purpose would Person A provide data about herself to the SaaS platform? Why would it differ from the situation when customer data is stored in on the platform? – writeren Jul 6 '18 at 7:58
  • Person A provide her name and e-mail as part of creating a user account, and that is personal data. – Arne Evertsson Jul 9 '18 at 17:04
  • Aha, I see. It might depend on the situation, but generally, I would say that the employer / company B is the data controller also in relation to the employees, since it determines the purposes and means of the processing of personal data. The SaaS platform simply provides the software, but the employer is directly or indirectly decides that the employer should create a user profile on the profile. – writeren Jul 10 '18 at 8:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.