On July 2021, the European Data Protection Board (EDPB) released the second version of the Guidelines 07/2020 on the concepts of controller and processor in the GDPR after a public consultation that was launched in 2020.

The Guidelines provide clarifications relating to the concepts of data controller, data processor and joint controllership by touching on the consequences of attributing different roles. To this end, the Guidelines will contribute to harmonise the definitions of the involved figures in the European countries and, accordingly, to determine the responsibility relating to GDPR-based data-processing activities. Moreover, it describes the relationship between controller and processor and among joint controllers.

A useful flowchart to practically determine the specific roles of controller, processor and joint controllers is also provided as an annex to the Guidelines.