This states that S.E. is a data processor and customers are the data controller . However after we enter data it is S.E. which determines how it is shown and/or delivered (i) to their servers . So shouldn't S.E. be the data controller in this regard? And here for integration with M.S. Teams S.E. states it is a joint controller with the customers . Like how is this determined? Have posted several downvoted questions on GDPR.GOOGLE states that GOOGLE is the data controller and app developers are joint controllers. So again, Like how is this determined? On top of that does the responsibility according to GDPR for the data collected by one joint (b) controller also shared with controller (a) who is the other controller?. Then have seen several sites where it just seems one controller has just linked to the other controller ( who claims to be responsible under the GDPR ) and has basically left all responsibility to them . Obviously it is not possible to ensure compliance of third parties . However if one uses some uses GitHub Pages to host a website or use AdMob in one's app one must receive GDPR requests and probably forward them to GOOGLE or Github somehow but the developer cannot ensure they comply.Also how will the developer keep consent records? Everyone does not capital at beginning to host a server and if one does one mst obey more laws! **EVERYTHING JUST SEEMS TO CONTRADICT!!**So can one explain this confusion. Have tried to do make the wording of this question as good as possible .

  • Have mixed up all these cases . There have been recommendations to just leave app development as have not done any already. However want to know the law properly. Still it seems GDPR compliance if not impossible is very hard. Nov 5, 2020 at 13:18
  • Here law.stackexchange.com/questions/40746/… again how is github not the controller if its servers log ip address? Nov 5, 2020 at 13:22
  • On combining all these cases it is becoming super confusing. Nov 5, 2020 at 13:22
  • 2
    There are reasons to downvote besides being offended. Personally I downvoted because you made no effort to make the question readable. I get that English isn't your first language, but I don't think that's an excuse for the wall of text with random fortmatting throughout. Nov 5, 2020 at 15:02

1 Answer 1


StackExchange is a processor under GDPR because it processes the data you provide it when you sign up and input personal information.

It's determined by an analysis of what function(s) the business is performing. If you are merely processing the data but don't have control over it (e.g. another business is using your software to do something with data that it is providing you) then you are likely to be a data processor.

Conversely, if you control the data, you are likely to be a data controller.

It is possible to be both a data controller and a data processor at the same time.

That specific link in your post goes on to state:

Our business customers may qualify as controllers when they purchase certain of our products and services. We act as processors on behalf of such Customers.

This is referring to the Teams product that StackExchange offers or whatever the "internal company-only question and answer site" product they offer is called.

  • When an user uses a site hosted on another server of some hosting company like github pages it is said that the site maker is data controller for ip address logs however he does not log them its either github logging or the user giving .Still the site developer is comntroller this contradicts your oint it seems. Can you clarify? Nov 5, 2020 at 14:25
  • The developer is likely a joint controller with GitHub. GitHub is additionally a data processor.
    – Matthew
    Nov 6, 2020 at 18:09
  • Here law.stackexchange.com/questions/40746/… it apparently seems GitHub claims to be processor but logically for that set of information they should be controller. Nov 6, 2020 at 19:25

Not the answer you're looking for? Browse other questions tagged .