Hands-On Security in DevOps

GDPR security requirements for data processor and controller

According to the GDPR FAQ, A controller is the entity that determines the purposes, conditions and means of processing of personal data, while the processor is an entity which processes personal data on behalf of the controller.

For example, an e-commerce website that sells services to EU customers (data subjects). The e-commerce website is the data controller, which should comply with GDPR requirements. The software vendors who are data processors provide software services to the e-commerce website.

As compared with the data processor, the data controller will have more GDPR requirements to meet. That's why it's necessary to identify its role in the privacy data handing lifecycle. ...