Topic
Data Controller
12 published works
Inside Privacy
China’s DPO Reporting Requirement Now in Effect
By Yan Luo
On July 18, 2025, the Cyberspace Administration of China (“CAC”) issued an announcement (“Announcement”) launching a mandatory online registration system and requiring “personal information processing entities” (equivalent to “data controller”…
Data Privacy Dish
Is a market research company a processor or controller under the GDPR?
A controller refers to the entity that determines the “purpose and means” of how personal data will be processed. Determining the “purpose” of processing refers to deciding why information will…
Privacy World
What US Companies Need to Know About the New Draft GDPR Guidelines (Part 4)
By Kristin Bryan, Angelo Carosio
This fall, the European Data Protection Board (“EDPB”) published the draft “Guidelines 07/2020 on the concepts of controller and processor in the GDPR.” This development matters for CPW readers as…
La Revue
Lumières sur le projet de lignes directrices du CEPD sur les Responsables de traitement et Sous-traitants dans le cadre du RGPD (3ème partie)
Partie 3 : Les responsables conjoints de traitement Cet article est le troisième d’une série sur le projet de Lignes directrices 07/2020 sur les notions de responsable de traitement et de…
Data Protection Report
Thailand Personal Data Protection Law
By Tassanai Kiratisountorn, Pimchanok Eianleng, Anna Gamvros, Ruby Kwok (HK)
Background The Personal Data Protection Act B.E. 2562 (2019) (PDPA) was published on 27 May 2019 in Thailand’s Government Gazette and became effective the following day. However, most of the…
Privacy Compliance & Data Security
Who Is Responsible Under GDPR for Putting a Data Processing Agreement in Place?
By Odia Kagan
Who is responsible for putting a GDPR Article 28 Data Processing Agreement in place? Dutch Data Protection Authority, Autoreitpersoonsgegevens, says: BOTH the data controller and the data processor. As a…
Privacy Compliance & Data Security
Bulgaria: Medical Center Contracted By Insurance Company Is a Data Controller Under GDPR
By Odia Kagan
A medical center contracted by an insurance company to provide examinations and studies to individuals covered by insurance may be a "data controller" under the EU General Data Protection Regulation…
Blockchain and the Law
Is Blockchain Technology Compatible with GDPR? French Data Protection Regulator Provides Guidance
By Mathilde Pépin, Stéphanie Martinier, Tiffany Quach
Uncertainty regarding the compatibility of blockchain technology and the European Union’s General Data Protection Regulation (GDPR) has often been highlighted as a potential obstacle to the development and widespread implementation…
Privacy World
Personal Data Breach Notification Obligations Arise from Various Sources, not Only the GDPR
Since 25 May 2018, controllers experiencing a personal data breach must – as a general rule – notify it to the appropriate supervisory authority. Not all breaches will require notifications:…
Tech Law Blog
Court refuses to grant declaration as to identity of the data controller
The High Court, in In the Matter for Mount Carmel Medical Group (South Dublin) Ltd (In Liquidation) [2015] IEHC 450 considered the issue of who is a data controller under data protection…