The authority is controller and provider processor under | AIGP
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About

Language

✓ EnglishDeutschEspañolFrançaisPortuguês
Check readiness — free →

The authority is controller and provider processor under: Which role allocation follows actual purposes and

AIGP Understanding How Laws, Standards and Frameworks Apply to AI Medium

The authority determines purposes and means; the provider acts on documented instructions, making it a processor under GDPR.

The question

A housing authority subject to the EU GDPR hires a software provider to run an application-screening model. The authority sets the eligibility purpose, features, retention period, and decision rules. The provider may process records only on documented instructions and cannot use them for its own analytics. Which role allocation follows actual purposes and means?

Preparing for AIGP? Take the free 5-min readiness quiz →

  1. The provider is controller because it operates the model
    Operating technical infrastructure does not determine purposes and means when the authority sets those decisions and instructions.
  2. The provider is independent controller because every vendor chooses implementation methods
    Technical implementation choices alone do not establish independent purposes when the provider lacks its own use of the records.
  3. Both parties are processors because housing applications are outsourced
    Outsourcing does not eliminate controller accountability, and the authority determines purposes and essential means.
  4. The authority is controller and provider processor under documented instructions ✓
    The authority determines purposes and means, while the provider processes data on its behalf under documented instructions.
The trap
Ignore contract labels initially; identify who decides why and how personal data are processed.

How to remember it

The authority determines purposes and means; the provider acts on documented instructions, making it a processor under GDPR.

How many of these would you get right?

One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.

Test your AIGP readiness — free

More Understanding How Laws, Standards and Frameworks Apply to AI questions

Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI · Every answer, right and wrong, comes with its own explanation.