Data Controller and Data Processor: What Role Does a SaaS Company Play Under the GDPR?

A SaaS company rarely performs only one role when processing personal data. For information that clients upload to the service, it may act as a Data Processor. At the same time, the company acts as a Data Controller for data relating to account holders, payments, security, and its own marketing.

Correctly determining the role is important not only for the Privacy Policy and DPA. The role determines who selects the legal bases for processing, responds to user requests, engages contractors, and makes decisions in the event of a data breach.

Simply specifying the role in the agreement is not enough. Under the GDPR, the role is determined based on the parties’ actual activities.

Who Is a Data Controller

A Data Controller, or controller, determines the purposes and essential means of processing personal data. Simply put, it decides why the data is needed and how it will be used.

The controller independently determines:

• which categories of data to collect;
• the purposes for which the data will be used;
• how long the data will be retained;
• to whom the data will be disclosed;
• the legal basis on which the data will be processed;
• how users will be able to exercise their rights.

For example, a SaaS company independently decides to collect the names and email addresses of account holders for registration, use payment data for billing, and analyze login history to protect the service. In relation to these processing operations, the SaaS company is the Data Controller.

A controller does not necessarily need to have direct access to all the information. The key criterion remains its ability to determine the purposes and essential elements of the processing.

Who Is a Data Processor

A Data Processor, or processor, processes personal data on behalf of the controller and in accordance with its documented instructions.

A typical example is when a corporate client uploads information about its employees or customers to a SaaS system. The client determines which data to place in the service, why it should be used, and when it should be deleted. The SaaS company provides the technical infrastructure and processes the data on behalf of the client, meaning that it acts as a processor. As a rule, such a relationship must be governed by a Data Processing Agreement (an agreement on the processing of personal data). Such an agreement may need to account for the specific requirements of target regions, particularly the United States and the UK, so a single agreement for all countries worldwide may not be sufficient.

The provider may independently select certain technical means of processing, such as software, storage architecture, backup methods, or security measures. This does not necessarily make it a controller if the purposes of the processing continue to be determined by the client.

However, a processor may not use the data it receives for its own purposes. If a SaaS company begins independently analyzing the client’s database, using it for advertising, or creating its own products based on it, its role in relation to such processing may change.

Why a SaaS Company Usually Performs Both Roles

The role is determined not for the company as a whole, but for each individual personal data processing operation.

SaaS as a Data Processor

A company generally acts as a processor when it stores and organizes data that a client uploads to a workspace, provides authorized employees with access to it, creates backups, or deletes information on the client’s instructions.

For example, a CRM platform processes customer information entered by the company using the platform. The client determines the purposes for which this data is processed, while the CRM acts as its processor.

SaaS as a Data Controller

With respect to its own activities, the service makes decisions independently. This generally applies to account registration, subscription management, billing, fraud prevention, and compliance with legal obligations.

A SaaS company may also act as a controller when sending its own marketing communications, analyzing website traffic, and handling customer support requests.

As a result, the same user may be involved in several processing operations at once. Their data within the workspace is processed on behalf of the client, while the account administrator’s contact details are processed for the performance of the agreement with the SaaS provider itself.

Can a SaaS Company Be a Joint Controller?

Joint Controllers jointly determine the purposes and essential means of the same processing operation.

This role does not arise from every form of cooperation. The mere existence of a joint project, integration, or exchange of information does not make the parties Joint Controllers.

Joint controllership may arise if the SaaS company and the client jointly decide what the data will be used for and how the processing will be organized. Their decisions may be common or complementary, but both parties must have a genuine influence on the purposes and means of processing the information.

In this case, the areas of responsibility must be determined in an arrangement between the controllers: who provides information to users, handles requests, ensures that an appropriate legal basis exists, and reports data breaches. The essence of the allocation of responsibilities must be made available to data subjects.

At the same time, both controllers remain responsible for the processing of personal data. During an investigation, a supervisory authority may take into account the allocation of responsibilities between the controllers and impose a lower level of liability on a controller whose area of responsibility did not include the relevant processing; however, the existence of an arrangement does not fully release either party from its GDPR compliance obligations.

How to Determine the Role of a SaaS Company

The analysis should begin with a map of processing operations rather than a general statement in an agreement. Several questions should be answered for each process.

Who decided to collect the data? If the SaaS company initiated the collection and the processing is required for its own purposes, this indicates that it is acting as a controller.

Who determines the purpose? A client may use the platform to manage employees, patients, or customers. If the SaaS company merely provides the tool, it is most likely acting as a processor.

Can the provider use the data independently? A processor acts only within the scope of instructions. Independent analytics, advertising, or the sale of information indicate a separate role as a controller.

Who determines the retention period? If the client makes the decision and the service implements the relevant settings, this is characteristic of a controller-processor relationship. If the retention period is determined by the SaaS company for its own invoices or security logs, it acts as a controller.

What happens after the agreement ends? The client should understand whether the data can be exported, when it will be deleted, and whether backup copies will be retained.

The same process cannot be accurately characterized without taking into account the product, its settings, and the parties’ actual arrangements.

What Obligations Does a Controller Have?

The Data Controller is responsible for the lawfulness of processing and must be able to demonstrate compliance with the GDPR.

It determines the legal bases for processing, provides information to users, complies with retention periods, and facilitates the exercise of data subjects’ rights. The controller also selects processors that can provide sufficient guarantees regarding data security.

For a SaaS company acting as a controller, this means that its own processing operations cannot be fully shifted to the client or a contractor. For example, the company itself is responsible for account data that it uses for billing, security, and marketing.

What Is a Processor Responsible For?

A Data Processor must act in accordance with the controller’s documented instructions and ensure the confidentiality and security of the data.

Its responsibilities may also include assisting the client with handling data subject requests, conducting DPIAs, and investigating incidents. If a data breach occurs, the processor must notify the controller without undue delay and provide the available information about the incident.

After the services end, the data must be returned to the client or deleted in accordance with the agreement, unless further retention is required by law.

If the processor goes beyond the instructions and independently determines the purposes and means of processing, it may be considered a controller in relation to such processing.

Why Does a SaaS Company Need a DPA?

The relationship between a controller and a processor is governed by a Data Processing Agreement. A DPA may be a separate document or part of the main agreement, but it must contain the mandatory provisions required by the GDPR.

The agreement specifies the subject matter and duration of the processing, categories of data, groups of data subjects, and the client’s rights and obligations. In addition, the DPA governs:

• the procedure for issuing instructions;
• confidentiality requirements;
• technical and organizational security measures;
• the engagement of subprocessors;
• assistance with data subject requests;
• data breach notifications;
• audits;
• the return and deletion of data.

A DPA should not simply repeat the text of the GDPR. It should explain how the parties comply with the requirements in the context of the specific service.

Who Are Subprocessors?

A SaaS company rarely stores and processes all information independently. It may use cloud hosting, email services, technical support, analytics, and other external solutions.

If such a contractor gains access to data that the SaaS company processes on behalf of the client, it may be considered a subprocessor.

Engaging a subprocessor requires the controller’s prior specific or general written authorization. The SaaS company must inform the client of changes to the list of subprocessors and provide the client with an opportunity to raise **objections**, where this is provided for by the applicable authorization model.

The subprocessor must be subject to data protection obligations comparable to those imposed on the primary processor. At the same time, the SaaS provider remains responsible to the client for the subprocessor’s actions.

Common Mistakes SaaS Companies Make

Assigning one role to all data. The statement “the company acts solely as a processor” may contradict its actual handling of account, payment, security, and marketing data.

Relying solely on the title of the agreement. The parties cannot arbitrarily choose their roles if their actual activities indicate otherwise.

Using client data for the company’s own purposes. Information obtained to provide the SaaS service should not automatically become a source for marketing or independent analytics.

Failing to distinguish between processors and subprocessors. If the company engages cloud and technical service providers to process client data, their involvement must be reflected in the DPA.

Copying a generic template. The agreement should take into account the product architecture, categories of information, the parties’ functions, and the actual data deletion process.