Who determines purposes and means: What must it examine?
GDPR roles depend on actual purposes and means; provider reuse for its own purposes may change the classification.
The question
A media company’s contract says a provider may reuse uploaded scripts to improve its service. Under the GDPR, for this arrangement and processing of identifiable employee scripts, the company wants to classify the parties correctly. What must it examine?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Who determines purposes and means, including reuse purposes. ✓Under the GDPR, actual decisions about purposes and means determine controller or processor roles; provider reuse may indicate its own purpose.
- Whether the contract assigns all privacy duties to the company.Contract language cannot by itself override the parties’ actual roles or remove applicable controller accountability under the GDPR.
- Whether the company pays for private model hosting.Hosting and payment arrangements may inform context, but do not determine who decides purposes and means under the GDPR.
- Whether the provider advertises itself as a processor.Marketing labels do not determine GDPR roles; the parties’ actual purposes and means of processing control the analysis.
The trap
Analyze actual purposes and means, especially independent reuse purposes; do not let marketing labels or contract wording decide GDPR roles. How to remember it
GDPR roles depend on actual purposes and means; provider reuse for its own purposes may change the classification.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How to Govern AI Deployment and Use questions
- Define model-incident triggers: Which mitigation should be prioritized? →
- Document the vendor’s purposes: What specific governance risk must be resolved before deployment? →
- Generated fluency is not verified evidence: What distinction must training establish? →
- All 424 Understanding How to Govern AI Deployment and Use questions →
Part of the Certsqill AIGP question bank · Understanding How to Govern AI Deployment and Use ·
Every answer, right and wrong, comes with its own explanation.