What happened?
On 2 September 2020, the European Data Protection Board
(“EDPB”) adopted its draft Guidelines 07/2020 on the concepts of
controller and processor in the GDPR
(“Guidelines”). The Guidelines, once
adopted, will replace the Opinion 1/2010 adopted by the Article 29
Data Protection Working Party1 with the objective to
provide updated guidance on the concepts of controller and
processor and further clarify their different roles and
responsibilities in the light of the General Data Protection
Regulation (“GDPR”)2.
Reminder: how to determine the roles of controller and
processor?
The roles of controller and processor are crucial since they
determine who shall be responsible for complying with certain
specific rules under the GDPR. However, those concepts are not
always easy to ascertain in practice. The Guidelines intend to keep
a consistent approach throughout the European Union on the
circumstances to consider when identifying controllers
