Data Protection in a Nutshell – A Quick Reference Guide

We understand whether the DPL applies to us

  • The DPL applies to personal data processed by ‘data controllers’ and ‘data processors’.
  • A ‘data controller’ determines why and how personal data is processed and is the entity ultimately responsible for the personal data.
  • A ‘data processor’ processes personal data on behalf of a data controller and does not itself determine why personal data should be processed. A data processor may, to a certain extent, decide on how the personal data should be processed.
  • Employees of the data controller are not data processors, they are considered part of the data controller.
  • A data controller who engages the services of a data processor must ensure that the engagement is based on a written contract, called a data processing agreement (DPA). The DPA contains certain prescribed conditions for the processing of personal data by the data processor.
  • The DPL does not apply to processing carried out by individuals purely for personal/household activities.
Previous Next