Glossary A–ZLetter D
Data processing on behalf of a controller (DPA)
Data processing on behalf of a controller takes place when a service provider processes personal data for a company and on its instructions; the rules are set out in Article 28 of the GDPR.
The commissioning company remains the controller, and the service provider is called the processor. The basis is a data processing agreement, in German usually abbreviated to AVV.
Anyone who uses management software for screens as a cloud service generally hands personal data to the provider: user accounts of the editorial team, login logs and, with queue management systems, customers’ names or waiting numbers. An agreement of this kind is then usually required. Among other things it covers subject matter and duration, the type of data, the technical and organisational safeguards, the use of further providers (sub-processors) and deletion or return of data when the contract ends.
Whether processing on behalf actually applies depends on the individual case; a maintenance or hosting contract may be one, but need not be. Operators should know the list of sub-processors and their locations, as this partly decides whether data leaves the EU. The agreement does not relieve the operator of its own responsibility, for example for deciding which data belongs on a screen at all. This explanation is not legal advice.