Five GDPR Myth-Busters

In this back-to-basics blog, Fieldfisher's Data team sets out to debunk five common misconceptions about UK and EU data protection law.

Myth 1: "I am a data processor because that's what it says in my contract"

Think again! Whether a party is a controller or a processor is not dictated by the contract: this is a question of fact. Put simply, if they are calling the shots about how and why personal data is used, they will be a data controller – even if the contract positions them as a processor.

It is important to note that a party can be both a controller and a processor of the same data. For instance, a service provider engaged as a data processor to provide contracted services can also stray into controllership by using the data for their own purposes (such as analytics and service improvements). You can read our blog about the French regulator's commentary on processors using data for their own purposes here.