For the purposes of this Regulation: [...] (7) 'controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; (8) 'processor' means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; [...] Article 28 [...] 3. Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: (a) processes the personal data only on documented instructions from the controller, [...] Article 29 Processing under the authority of the controller or processor [...] The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.
How this was checked
GDPR controller, processor, and a child's consent
Verified · last checked Settled, with the evidence a claim at this level needs.
Under the GDPR, the controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data, and where Union or Member State law determines those purposes and means, that law may name the controller or the criteria for naming it; a processor is a person or body which processes personal data on behalf of the controller. Processing by a processor must be governed by a contract or other legal act binding the processor with regard to the controller, which requires among other things that the processor processes the data only on the controller's documented instructions. The processor and any person acting under the authority of the controller or of the processor who has access to personal data may not process those data except on instructions from the controller, unless Union or Member State law requires it. Where an information society service is offered directly to a child and point (a) of Article 6(1) (consent) applies, the processing of the child's personal data is lawful where the child is at least 16, and below that age only if and to the extent that the holder of parental responsibility gives or authorises consent; Member States may lower that age by law, but not below 13.
At a glance
The statement laid out, in its own words. The statement above and its sources are what count.
Who is who, Article 4(7) and (8)
| Role | What the regulation says |
|---|---|
| Controller | Alone or jointly with others, determines the purposes and means of the processing; where Union or Member State law determines them, that law may name the controller or the criteria for naming it |
| Processor | Processes personal data on behalf of the controller |
Working through a processor, Article 28(3)
- Governed by a contract or other legal act binding the processor with regard to the controller
- The processor processes the data only on the controller's documented instructions
People with access, Article 29
- Anyone acting under the authority of the controller or the processor processes the data only on the controller's instructions, unless Union or Member State law requires otherwise
A child's consent to an online service, Article 8(1)
- Applies where the service is offered directly to a child and point (a) of Article 6(1) (consent) applies
- At 16 or over, the processing is lawful
- Below 16, consent is given or authorised by the holder of parental responsibility
- Member States may lower the age by law, not below 13
- Kind of evidence
- documentarySettled by a first-hand source, quoted below with the day it was read.
The evidence
Article 8 Conditions applicable to child's consent in relation to information society services 1. Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.
Every sentence in our books that makes a claim about the world points at a page like this one.