How do controllers, processors and sub-processors work?

Under Article 4 of the GDPR, the controller determines the purposes and means of processing, and the processor processes personal data on the controller’s behalf. A company is usually the controller of its customers’ data, and the cloud services it uses to store or handle that data are usually its processors.

Article 28 sets the rules. A controller may use only processors that give sufficient guarantees, and the processing must be covered by a written contract, often called a data processing agreement (DPA). It has to require the processor to act only on the controller’s documented instructions, keep the data confidential and secure, help with people’s rights requests, and delete or return the data when the service ends.

A processor can engage a sub-processor only with the controller’s prior written authorisation, given for each one or in general. Under a general authorisation, the processor must tell the controller about new or replaced sub-processors so it can object, which is why many vendors publish sub-processor lists. The same data protection obligations pass down to each sub-processor.

For example, when a SaaS company uses a hosted help desk, the help desk is its processor, and the help desk’s cloud hosting provider is a sub-processor. A processor that starts deciding the purposes and means for itself is treated as a controller for that processing.

Sources

Why do processors matter for a website voice agent?

A voice agent passes each conversation through several services: a speech or language model, a database, hosting and email. If the vendor is your processor, every service that handles personal data for it is a sub-processor in your chain, and your records and privacy notice need to reflect them.

Before customers talk to the agent, ask for the list, where each service processes data and what contract covers it.

Which services handle data for Kawl Now

These are the services involved when you use Kawl Now. It doesn’t yet offer a data processing agreement, product terms or a privacy notice for pilot workspaces, so if you need a DPA, ask before you switch on customer calls.

  • OpenAI processes the voice conversation, with audio passing directly between the caller’s browser and OpenAI. It also analyses callers’ words from recent calls to produce automatic insights, and writes and voices the private briefing your team hears before a handover.
  • Supabase stores the database in London, including transcripts, knowledge, usage records, insight reports and customer sign-in accounts.
  • Railway hosts the application in its EU West region.
  • Resend sends sign-in and notification emails.
  • GitHub is contacted only when you import documentation from it.
  • Twilio is used only for human handover, an early release. It verifies your team’s UK or US phone number and carries each handover call from the caller’s browser to that phone, in Twilio’s default region, the United States.
Sources

Common questions

How does a data controller differ from a data processor?

The controller decides why and how personal data is processed and carries most of the legal responsibility. The processor acts only on the controller’s documented instructions, under a contract the GDPR requires.

Does a data processor need permission to use a sub-processor?

Yes. Under Article 28 of the GDPR, a processor needs the controller’s prior written authorisation, specific or general. With a general authorisation, it has to tell the controller about any new or replaced sub-processor, so the controller can object.