|
Currently, the Data Protection Acts 1988 and 2003 (“DPA”) contain obligations on both Controllers and Processors engaged in the processing of personal data. The introduction of the GDPR will mean that the obligations on Controllers and Processors engaged in the processing of personal data will broaden and strengthen. Whether you are acting as a Controller or a Processor under the DPA or indeed, the GDPR, will be a question of fact which you will need to assess on a case-by-case basis. Processors, for example, must only process personal data on the documented instructions of a Controller. A Controller, on the other hand, defines the purposes and means of the processing of personal data. More information in respect of the roles of Controllers and Processors is available on the Data Protection Commissioner’s (“DPC’s”)website.
|