The role you have is the role you act

How we work

Why we settle it before the credentials

When a supplier runs a client's systems, the personal data inside them does not change hands but responsibility for it has to be allocated exactly. The client determines what the data is for and is therefore the controller. The supplier acts on instructions and is therefore the processor. What makes this more than a formality is that the roles follow conduct rather than paperwork: a processor which begins determining the purposes and means of a processing operation is treated as a controller for that processing, and acquires a controller's obligations whether or not anyone intended it. A supplier who starts quietly deciding what data gets used for has changed its legal position without noticing.

The written agreement exists to keep the roles where both parties think they are. It records the subject matter and duration, the nature and purpose of the processing, the types of data and the categories of people, and the controller's rights and obligations. It also settles the things that are painful to negotiate later: whether a sub-processor may be engaged and on whose authorisation, how requests from individuals are handled, and what happens to the data at the end, which should be return or deletion at the client's choice. None of that works if access is granted first and the paperwork follows.

Breach handling has a similar asymmetry worth being blunt about. A controller must notify the supervisory authority without undue delay and, where feasible, within seventy-two hours of becoming aware. A processor must notify the controller without undue delay. Those are different duties with different recipients, and in practice it means a supplier should tell the client the moment it knows rather than when it has a tidy explanation, because the client's seventy-two hours begin at that moment. Since October 2024 the Belgian network and information security regime adds a second rhythm on top for providers of managed services, with an early warning inside twenty-four hours, a notification inside seventy-two and a final report within a month, together with something no supplier can take off a client's hands: the management body must approve and supervise the measures, and can be held liable for failing to.