gdpr business personal-information
Shoud a company send to customers of its clients notice when getting data about them under GDPR Article 14?
<p>A SaaS company (<strong>A</strong>) provides services, (e.g. web hosting) for its clients, (e.g. web agency <strong>B</strong>).
The clients can create websites for their customers (<strong>C</strong>) and host them using the web hosting.
Web agencies can also create child accounts for their clients in the hosting dashboard (user management). Child user accounts or hosted websites may contain personal data.</p>
<p>According to GDPR Article 14, should <strong>A</strong> send notice about private data to <strong>C</strong> when <strong>B</strong> creates child account for <strong>C</strong> or hosts site of <strong>C</strong>?</p>

<p>No, The SaaS company should strive to be a Data Processor for the web agency, and the web agency will likely want to be a Data Processor for its customers in turn. A Data Processor processes the personal data only as instructed by the Controller. The SaaS company should not be a Data Controller itself.</p>
<p>Being a Data Processor requires a contract that fulfils the condition in Art 28 GDPR.</p>
<p>It is the Data Controller's responsibility to provide transparent information to Data Subjects. However, some of the involved tasks can be outsourced to a Data Processor.</p>
<p>If the SaaS company deals with customers directly, the company might be a Controller for some and a Processor for others, or possibly both but for different processing activities. This depends on whether the customer is a Data Controller, Data Subject, or both in this context. If the SaaS company receives data from third parties in its capacity as a Controller, then yes, it must inform the data subjects as required per Art 14. But the mere creation of an account would likely not mean that personal data was obtained from a third party. This ultimately depends on the details of the account creation process, though.</p>
