Question

A European retailer engages a cloud-based marketing analytics SaaS to run campaigns. The retailer decides which customer datasets to upload, the campaign objectives, and the retention periods. The SaaS provider stores and processes the data strictly according to the retailer's documented instructions and does not use the data for its own purposes. Under GDPR, how should the parties' roles be classified, and what is the primary compliance consequence?

Accepted Answer

The retailer is the data controller and the SaaS provider is the data processor; a written data processing agreement (Article 28) defining the processor's obligations is required.

Answer

Both parties are joint controllers because the provider physically holds the data, so each independently owes the same direct obligations to data subjects.

Answer

The SaaS provider is the controller because it operates the infrastructure that determines how the processing physically occurs.

Answer

The retailer is a processor and the SaaS provider is a sub-processor, so no formal contract between them is necessary.