Whether the vendor determines purposes or means: Under the GDPR, which fact determines the vendor’s role for
Under the GDPR, actual purposes and means—not contractual labels—determine the vendor’s role for independent reuse.
The question
A university research office in the EU uses a vendor to analyze participant data. The contract calls the vendor a processor, but the vendor may reuse the data to improve its own general model. Under the GDPR, which fact determines the vendor’s role for that reuse?
Preparing for AIGP? Take the free 5-min readiness quiz →
- The research character of the data.Research context does not automatically authorize reuse or determine the vendor’s GDPR role; actual purposes and means remain decisive.
- Whether the vendor determines purposes or means. ✓For the reuse activity, the vendor may be a controller if it independently determines the purposes or means of processing the participant data.
- The university’s continuing accountability.The university may remain accountable for its processing, but that does not determine the vendor’s separate role for independent reuse.
- The contract’s role label.A contractual label does not settle the GDPR role when the vendor’s actual processing purposes and means differ.
The trap
Analyze each processing activity separately and ask who determines its purposes and means. How to remember it
Under the GDPR, actual purposes and means—not contractual labels—determine the vendor’s role for independent reuse.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How to Govern AI Deployment and Use questions
- Specify incident triggers: Which requirement is decisive? →
- A new subprocessor changes the dependency profile: Which distinction is decisive? →
- Termination requires clearer data-handling terms: Which distinction is decisive? →
- All 424 Understanding How to Govern AI Deployment and Use questions →
Part of the Certsqill AIGP question bank · Understanding How to Govern AI Deployment and Use ·
Every answer, right and wrong, comes with its own explanation.