Whose data is it to manage?
A sports club asks a survey firm to collect fitness answers from its members. The firm types the answers into a computer system. A member asks: "Who is in charge of my data?"
The law gives a clear answer. Three different roles share the work, and each has its own duties.
Key words
| Word | What it means | Example |
|---|---|---|
| Personal data | Information about a living person who can be identified. | |
| Data controller | The organisation that decides why and how personal data is used. | the sports club |
| Data processor | An organisation that handles data only as the controller tells it to. | the survey firm |
| Data protection officer | A person who checks that an organisation follows data protection law. Short form: DPO. | |
| Data processing agreement | A written contract between a controller and a processor. | |
| Regulator | An official body that checks rules are followed. | the ICO |
| Policy | A written rule that an organisation sets for its staff. | |
| Compliance | Following the laws and rules that apply. | |
| Instruction | An order from the controller about what to do with the data. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can describe the controller, processor and data protection officer, and say what a data processing agreement is for.
Starter: last lesson
Have a go
Starter: last lesson
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
The controller decides
The controller is in charge. It decides why the data is collected and what the outcome should be. It manages the organisation's data and is responsible for it.
In our story, the sports club is the controller. It wants to know how fit its members are.
The processor does the work
The processor does tasks on the data because the controller told it to. It may collect the data. It must deliver what the agreement says and nothing else.
The survey firm is the processor. It may not use the fitness answers for its own reasons.
What each role does
| Role | Main duties | Example |
|---|---|---|
| Controller | Manages the data and sets the purpose | Club decides to measure fitness |
| Processor | Follows instructions, collects data, delivers as agreed | Firm collects and types answers |
| DPO | Checks compliance with the law | Reviews the survey plan |
| DPO | Is the formal contact for regulators | Answers a letter from the ICO |
| DPO | Identifies where policies are needed and checks their quality | Checks the club's data policy is clear |
| DPO | Teaches staff about data protection | Runs a short training session |
| DPO | Makes sure data protection standards are met | Audits how files are stored |
The cells students fill in are left blank in this preview.