Data processing on behalf
Data processing on behalf occurs when an organisation processes personal data for a controller. The actual tasks and instructions matter, rather than the title of a contract alone.
Published
What it means for your shop
If you decide the purposes and means of processing, you are generally the controller for that activity. A service provider may process data under your documented instructions, and the same provider may be a controller for other activities. Look at each data flow on its own: running your customer card is one, billing for your software subscription is another.
Article 28 GDPR (German consolidated text) sets out requirements for processors and their contractual basis. A data processing agreement, or DPA, specifies matters including the subject, duration, purpose and data involved. It also covers safeguards, assistance and what happens to data when the service ends. The lawfulness of your own purposes remains your decision as controller.
How to recognise it
A customer asks for their details to be changed. A clear process sets out who assesses the request and who makes the technical change on instruction. This is where the concept becomes tangible in everyday work. Note internally who receives such requests, and use the agreed contact channels.
At Treubar
The Treubar DPA describes processing for your business and separates it from activities for which the provider is a controller, such as its account and billing data. The privacy policy explains the processing it covers in more detail. Together they give you a clear picture of who does what.