General legal education
Controller vs Processor
The controller decides why and how data is processed; the processor acts on instructions.
General legal education
Delegating a task does not delegate accountability. The controller remains responsible for the lawfulness and scope of what the processor does.
The processing agreement should define exactly which data the processor may access for which task.