Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
I work for a web development company and we are developing a web app for our client. The web app and database will be hosted on the client's server. Our involvement will just be to update the codebase and database schema as required.
For the purposes of GDPR, are we a data processor as we develop the web app?
If you merely provide software for your client to use, you are not processing personal data on behalf of the client.
But if you have access to systems that store personal data, then you must consider the GDPR. Or more accurately: your client must consider the GDPR. Under what legal basis can they give you access to the data in these systems? The easiest way to solve this is indeed if you act as the client's processor.
Processor status is never the default, but requires a binding contract with the data controller. This contract will require you to only process personal data as explicitly instructed by the client, and may require you to take certain security measures as a precaution.
Without such a contract you aren't a data processor, but possibly a data controller of your own (with all the compliance obligations that implies).
If you have developed the Software and will continue to render support services to that software you also have access to the Data, therefore you act as a Processor (it's not a matter of you deciding or not to access it, it's a matter of having the possibility to access the Data).
If you have developed the Software and will never again "interact" with it, then you are not a Processor nor Controller.
Now speaking of Controller, if the software was developed under Client instructions, the Client is the Controller, however if you have a software suite that enables by default some features and the Client may chose some or all + you maintain the tool (support services), then you are in fact a Co-Controller (not just a Processor).
You really should do your own internal operational assessment, unless this is the only client you have.
Opposite to what Amon just said, Processor Status does not require a Contract with the Controller... you can be a Processor with no Contract whatsoever, be very careful with that... now this means that you should (must) have a contract so that both parties are "protected"... if there is no contract both companies are breaching GDPR (if GDPR is applicable of course).
Be very careful with the remark ".. without such contract you are not a Data Processor..." it's not a matter of contract... it's about WHAT you effectively DO!
