1. Introduction
Many businesses move quickly into partnerships and business
arrangements that rely on the exchange or integration of personal
data. They share data here, connect an Application Programming
Interface (API) there, link systems, combine datasets, and roll out
solutions that depend on continuous information flows to
third-party organisations. In the middle of this pace, one
essential question can be overlooked: What is the role and
responsibility of the organisation in the data processing
relationship?
What we mean here by a data processing relationship is any
arrangement where two or more organisations handle or process
personal data together, whether through integrated systems,
outsourced services, collaborative projects or shared platforms.
More specifically, these relationships take different forms,
including controller–processor,
processor–sub-processor, joint controller and joint processor
arrangements.
