[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-241732-105":53,"doc-detail-241732-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","flowcharts-and-checklists-on-data-protection","Flowcharts and Checklists on Data Protection","","Flowcharts and checklists clarify roles and responsibilities under the EU Data Protection rules. The material helps determine whether an organization acts as a processor, controller, or joint controller when roles are not fixed in legislation, and outlines practical implications for each position. It summarizes controller and processor duties, expectations for processing agreements, accountability requirements, and guidance questions. It also covers data transfers, enforcement powers of the EDPS, and administrative fines and EUDPR infringements.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/flowcharts-and-checklists-on-data-protection/241732/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/flowcharts-and-checklists-on-data-protection/241732.png","ImageObject",442,249,{"name":88,"@type":89},"Dipper","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-11","2026-09-12",true,{"@type":98,"interactionType":99,"userInteractionCount":73},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"How do you determine whether you are a processor, controller, or joint controller?","Question",{"text":108,"@type":109},"Use the flowchart to assess who determines purposes and essential means in practice, and whether this determination is shared with another party or based on explicit or implicit legal competence.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"What are the key duties of the controller?",{"text":113,"@type":109},"The controller must ensure lawful, fair, and transparent processing; follow purpose limitation and data minimisation; maintain accuracy and storage limitation; protect integrity and confidentiality. It must also document processing, conduct DPIAs when needed, consult the EDPS for high-risk operations, implement privacy by design/default, notify breaches, conclude appropriate agreements, and provide information and rights access for data subjects.",{"name":115,"@type":106,"acceptedAnswer":116},"What must be included or addressed in a processing agreement?",{"text":117,"@type":109},"Checklist 3 focuses on what is required for agreements/contracts with processors, including using only processors providing sufficient guarantees, and establishing the required arrangements for data protection responsibilities and compliance.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},241732,1791732637,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":135,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":136,"language":137,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":61,"update_tm":141,"read_time":142},1374404997633,"https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd","Flowcharts and Checklistson Data Protection  \n© European Union 2020  \nReproduction is authorised provided the source is acknowledged.  \nPDF ISBN 978-92-9242-461-9 doi: 10.2804/823679 QT-02-20-505-EN-C PRINT ISBN 978-92-9242-462-6 doi: 10.2804/912368 QT-02-20-505-EN-N  \nTable of Contents  \nFlowchart: are you a processor, controller or joint controller? ............................... 3  \nChecklist 1: What are the duties of the controller? ..................................................... 4  \nChecklist 2: What are the duties of the processor? ..................................................... 7  \nChecklist 3: What is required in a processing agreement?....................................... 8  \nUseful hints and questions on data protection ......................................................... 10  \nData transfers and Brexit .................................................................................................... 13  \nPowers of the EDPS under Regulation (EU) 2018/1725  \n(EU institutions Data Protection Regulation-EUDPR) ............................................ 14  \nAdministrative fines and sanctions under EUDPR .................................................... 16  \nEUDPR- Infringements ....................................................................................................... 17  \nAre you a processor, controller or joint controller?  \nThis w chart is for situations where the allocation of the processor and controller roles has not been established in a legal act.  \nYou jointly determine some essential means and purposes with B, while others are determined separately.  \nFlowchart for EUIs. You are involved in a processing operation with one or more third parties: are you a processor, a controller, or a joint controller?  \nYes  \nNo  \nNo  \nDo you determine certain purposes and essential means of the processing operationin practice?  \nNo  \nDo you determine certain purposes and essential means of the processing operation, based on a specic legal competence?  \nDo you determine certain purposes and essential means of the processing operation,based on an implicit competence?  \nWhat is the relationship between you (A) and the other party (B)?  \nYou are a processor  \nYou jointly determine the purposes and essential means for the processing operation with B.  \nOnly you determine the purposes and essential means of the processing operation.  \nA +  \nB  \nA  \nA  \nB  \nA  \nYou and B are joint controllers.  \nYou are joint controller with B for the jointly  \ndetermined parts of the processing operation.  \nYou are a controller, B is your  \nprocessor.  \nB is controller for its own means and purposes, but processor for yours.  \nYou are a controller.  \n1  \n2  \n3  \n4  \n!  \nYou and B separately determine purposes and essential means for the processing operation.  \nB  \nNote: The aim of this owchart is to clarify the initial qualication as controller or processor, rather than setting out what happens when a processor exceeds its mandate/role by becoming involved in determining essential means of the processing.  \nChecklist 1:  \nWhat are the duties of the controller?  \nProcessing of personal data needs to adhere to the following principles:  \n• the processing operation should be lawful, fair and transparent (lawfulness, fairness, transparency);  \n• the processing operation should be bound to specific purposes (purpose limitation);  \n• the personal data processed should be adequate, relevant and limited to what is necessary (data minimisation);  \n• the personal data should be accurate (accuracy);  \n• the personal data should be kept no longer than necessary (storage limitation);  \n• the personal data need to be remain well secured and confidential (integrity and confidentiality) .  \nSee the EDPS guide Accountability on the ground, part II, pages 11-15 for guiding questions on these data protection principles.  \nThe controller is responsible for compliance with these principles and should be able to demonstrate this com","cbCaioqpr4uoNJCc","https://ap.wps.com/l/cbCaioqpr4uoNJCc","pdf",2627572,8,20,"English","# Flowchart: are you a processor, controller or joint controller?\n# Checklist 1: What are the duties of the controller?\n# Checklist 2: What are the duties of the processor?\n# Checklist 3: What is required in a processing agreement?\n# Useful hints and questions on data protection\n# Data transfers and Brexit\n# Powers of the EDPS under Regulation (EU) 2018/1725\n# Administrative fines and sanctions under EUDPR\n# EUDPR - Infringements","[{\"question\":\"How do you determine whether you are a processor, controller, or joint controller?\",\"answer\":\"Use the flowchart to assess who determines purposes and essential means in practice, and whether this determination is shared with another party or based on explicit or implicit legal competence.\"},{\"question\":\"What are the key duties of the controller?\",\"answer\":\"The controller must ensure lawful, fair, and transparent processing; follow purpose limitation and data minimisation; maintain accuracy and storage limitation; protect integrity and confidentiality. It must also document processing, conduct DPIAs when needed, consult the EDPS for high-risk operations, implement privacy by design/default, notify breaches, conclude appropriate agreements, and provide information and rights access for data subjects.\"},{\"question\":\"What must be included or addressed in a processing agreement?\",\"answer\":\"Checklist 3 focuses on what is required for agreements/contracts with processors, including using only processors providing sufficient guarantees, and establishing the required arrangements for data protection responsibilities and compliance.\"}]","Flowcharts and Checklists on Data Protection | PDF",1789179790,7]