A SaaS company (A) provides services, (e.g. web hosting) for its clients, (e.g. web agency B). The clients can create websites for their customers (C) and host them using the web hosting. Web agencies can also create child accounts for their clients in the hosting dashboard (user management). Child user accounts or hosted websites may contain personal data.

According to GDPR Article 14, should A send notice about private data to C when B creates child account for C or hosts site of C?

1 Answer 1


No, The SaaS company should strive to be a Data Processor for the web agency, and the web agency will likely want to be a Data Processor for its customers in turn. A Data Processor processes the personal data only as instructed by the Controller. The SaaS company should not be a Data Controller itself.

Being a Data Processor requires a contract that fulfils the condition in Art 28 GDPR.

It is the Data Controller's responsibility to provide transparent information to Data Subjects. However, some of the involved tasks can be outsourced to a Data Processor.

If the SaaS company deals with customers directly, the company might be a Controller for some and a Processor for others, or possibly both but for different processing activities. This depends on whether the customer is a Data Controller, Data Subject, or both in this context. If the SaaS company receives data from third parties in its capacity as a Controller, then yes, it must inform the data subjects as required per Art 14. But the mere creation of an account would likely not mean that personal data was obtained from a third party. This ultimately depends on the details of the account creation process, though.

  • Thanks @amon, what about the case when there is no B and the SaaS company deals directly with C which can be either a person or business? Commented Jan 22, 2021 at 19:01
  • 1
    @progmastery It doesn't really matter whether the customer is a business or not, since some forms of businesses like a sole proprietor are identical with the natural person running this business. Thus, a business account can also be subject to GDPR. Here, it would be more important to determine whether the customer is a data subject or another controller, or possibly both with respect to different processing activities. E.g. when using Google Docs, Google is the Controller for the free tier, but can be a Processor for a Workplace subscription. I've updated the answer accordingly.
    – amon
    Commented Jan 22, 2021 at 20:01
  • (I am not a lawyer and this is not legal advice) It should be noted that as stated in Australian data privacy act there seems to be no difference as such between controller and processor so be informed of requests from austraian citizen inside EU . Again I am not a lawyer I cannot advice you and I am not advising you on any legal matter . Commented Jan 24, 2021 at 6:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .