According to the General Data Protection Regulation (GDPR) laws, when are SAP customers considered data controllers?

Question

Options

• AWhen they extract legacy data in preparation for migration
• BWhen they engage other businesses in the European Union
• CWhen they request implementation of a cloud solution
• DWhen they use SAP cloud applications

• A
  14% (8)
• B
  4% (2)
• C
  75% (42)
• D
  7% (4)

Explanation

Under GDPR Article 4(7), a data controller is the entity that determines the purposes and means of processing personal data. Option C is correct because when SAP customers request implementation of a cloud solution, they are actively defining what personal data will be collected, why it will be processed, and how the system will handle it - the exact criteria that establish controller status. SAP, fulfilling those instructions, acts as the data processor.

Why the distractors are wrong:

• A (extracting legacy data): Data migration is a processing activity, not what legally establishes controller status - the role is defined by decision-making authority over purpose and means, not a specific task.
• B (engaging EU businesses): Operating with EU entities triggers GDPR applicability but does not itself determine whether you are a controller - many parties in a business relationship can be processors.
• D (using SAP cloud applications): In standard SaaS usage, SAP may govern the processing terms, meaning the customer's role as controller is not automatically established merely by logging in and using a preconfigured application.

Memory tip: Think "Controller = Calls the shots." The moment a customer specifies what they want built and what data it will handle, they're calling the shots - making them the controller before a single line of code is written.

No community discussion yet for this question.