Assume the following situation:
There is a cloud-software (SAAS) which is used by a school for basically three things:
Edit: The SAAS was designed with children facilities in mind: Nurseries, daycare-centres, schools, children sport-clubs.
- The administrative users of the school manage the school's base-data with it, meaning children, teachers, parents, classrooms, and the relationships between those
- Teachers may log in, an post homework, pictures to a timeline, and log absence or presence information of children
- Parents may log in to see what teachers posted about their children, report an excused absence, send messages to the teachers, or see any other information shared by the administrative users or the teachers
The SAAS-provider stores the data on servers in the EU, and uses a EU-based transactional mail provider. A DPA is available from both, and the SAAS has signed them.
As to my understanding the company providing the SAAS-software (provider) in this case is the processor.
The controller would be the client of the company (the school) because they decide which data it puts into the system.
There is no relationship between the SAAS-provider and the teachers or parents. They are managed (and their access rights are controlled) by the school administration.
Based on this, the following questions arise for me:
Am I right in assuming that in this case the school is the controller, and the SAAS-provider is the processor?
This would mean that, under GDPR-law, the SAAS-provider needs to provide a DPA and sign it with the school?
The responsibility of having the DPA signed lies with the school, and not with the SAAS-provider? The provider must provide it, and sign it if requested by the school?