[Back to Guidelines 07/2020 on the concepts of controller and processor in the GDPR] [Back to Flowcharts]

graph TD;
    A["'Is another party involved in the personal data processing in question?'"] --> |No| B["You are the sole controller and must decide on purposes and means of the processing"];
    A --> |Yes| C["Are you appointed as controller according to a legal act for the processing in question? (explicit legal competence)"];
    C --> |Yes| D["The legal act applies and you are the controller for that specific processing"];
    C --> |No| E["Is the processing necessary in order to carry out a task for which you are responsible according to a legal act? (implicit legal competence)"];
    E --> |Yes| F["You are the controller of the processing necessary to execute this task"];
    E --> |No| G["Do you decide:
    • the purpose or purposes that the data will be processed for
    • which personal data shall be collected and processed
    • which categories of individuals the processed data refer to
    • whether the processed data shall be disclosed and to whom
    • for how long the personal data will be stored"];
    G --> |Yes| H["You are the controller for this personal data processing"];
    G --> |No| I["Choose which applies:"];
    I --> J["I carry out processing on behalf of another party, in accordance with its instructions. I make decisions about certain non-essential means"];
    I --> K["I carry out processing on behalf of another party solely according to its instructions. I do not make any decisions on purposes and means"];
    J --> L["You are a processor"];
    K --> L;
    G --> |"I don't know"| M["Consider these factors:"];
    M --> N["Factors indicating controller:
    1. You obtain benefit/interest from processing
    2. You make decisions about data subjects
    3. Processing naturally attaches to your role
    4. Processing refers to your relationship with subjects
    5. You have complete autonomy in processing
    6. You've entrusted processing to external parties"];
    M --> O["Factors indicating processor:
    1. You process according to another's instructions
    2. Another party monitors your compliance
    3. No own purpose besides service provision
    4. You are engaged as a subprocessor"];

				    style B fill:#be474a
 				    style D fill:#be474a
            style F fill:#be474a
 				    style H fill:#be474a
	 	        style L fill:#2e5e4a
				    style N fill:#be474a
				    style O fill:#2e5e4a