Guidance for PII Processors
This domain tests Clause 8 and Annex B. The core idea is narrow authority: a processor does only what the controller's documented instructions allow, and the controls exist to keep it inside that boundary.
Role boundary
A PII processor processes PII on behalf of a controller. The moment it determines purposes or means for itself, it becomes a controller for that processing - even if the contract and the labels say otherwise. A processor engaging another party creates a sub-processor relationship that needs authorisation and flow-down of the same obligations.
Annex B control families
- Conditions for collection and processing - a customer agreement covering scope and instructions; no processing for the processor's own purposes; no use for marketing; handling instructions that may infringe privacy obligations; assisting the controller with its own obligations; records of processing; returning or deleting PII at the end of the relationship.
- Obligations to PII principals - support the controller in providing information and answering access, correction and erasure requests; tell the controller promptly when a request arrives directly.
- Privacy by design and by default - temporary files, retention limits, de-identification, processing only what instructions permit.
- Sharing, transfer and disclosure - a basis for transfers between jurisdictions, a list of destination countries, records of disclosures, notification to the controller of disclosure requests, handling of lawful requests from authorities, and controls over sub-contractors.
Worked example
A cloud backup provider receives a legally binding demand for a customer's data. Annex B expectations: verify the request is lawful, disclose the minimum necessary, notify the controller unless legally prohibited from doing so, log the disclosure, and confirm the sub-processor chain was authorised. The processor does not decide the outcome alone.
Traps that cost marks
- Using customer PII to improve the processor's own products - that is a controller purpose.
- Assuming processors owe no duties towards PII principals.
- No records of disclosures or of authority requests.
- Onward sub-processing without authorisation and contractual flow-down.