Vendors
Vendor roles
Understand the GDPR role of each vendor, processor, independent controller or joint controller, and how to confirm it. Privacyboard suggests but never decides the role for you.
Every vendor that handles personal data acts in a GDPR role. The role decides which contract you need and how the vendor appears in your documents.
#The roles
| Role | Meaning | Typical examples |
|---|---|---|
| Processor | Acts on your documented instructions, under a data processing agreement. | Hosting, email delivery, analytics configured for you. |
| Independent controller | Decides its own purposes and means for the data it receives. | Some payment and advertising providers. |
| Joint controller | You and the provider decide together why and how data is used. | Rare, for example some shared-audience advertising features. |
| Depends on activity | The role differs by feature or by your configuration. | Payment platforms and large suites. |
| Not sure | Not yet decided. | A new vendor. |
#Suggested, then confirmed
For tools in the catalog, a role is suggested as a starting point. Some tools, such as payment providers, can act in different roles depending on the agreement, so they ask you to choose. Privacyboard never infers a role from how you use a tool: you confirm every role.
#Why it matters
- Only vendors you confirm as Processor and that serve clients appear in the subprocessor section of your data processing agreement.
- Vendors that are independent controllers are described differently in your privacy policy.
- A processor needs a data processing agreement with you (Article 28). The catalog links to each vendor's own agreement where one is published.
#Check the vendor's agreement
For each vendor you can open the published agreement and follow a short checklist of what to look for: who the parties are, which data and purposes are covered, subprocessors, transfers outside the EEA, breach notice and what happens to data when you leave. Roles that depend on the agreement are shown with a reminder to verify in your own account.
#FAQ
#How do I know whether a vendor is a processor?
If it handles data only on your instructions to provide a service to you, it is usually a processor. If it decides on its own what to do with the data, it is a controller. When the vendor's agreement is unclear, confirm with the vendor.
#Why does Privacyboard not set the role automatically?
The role depends on the contract and your configuration, not only on the tool. Suggestions are starting points.
#Can I change a role later?
Yes. Documents that depend on it are flagged for review.
Privacyboard is a guidance tool, not legal advice. This page describes what the product does today. Found something unclear or out of date? Write to antoine@unmake.io.