Data Processor vs Controller
GDPR roles defining who decides how data is used (controller) and who processes it on their behalf (processor).
A controller determines the purposes and means of processing personal data; a processor acts on the controller’s instructions. The distinction affects responsibilities and contracts (DPAs). SaaS startups are often processors for their customers’ data and must contract accordingly.
Examples
A SaaS tool acts as processor for its customer (the controller). — A startup signs DPAs reflecting its processor role.
How it relates to The Startup Foundry
Getting data roles right is part of being a credible, investable company.