It seems that we hear about personal data almost every day on the news, in transport or in conversations with friends and colleagues. We are increasingly putting digital privacy rules into practice. However, we do not think that behind the security of our personal data is the work of DPOs and information security specialists.

One of the questions that a DPO asks himself when working with a new counterparty is what his role is:operator, co-operator, part of the operator or authorized person.

Let us remind you that the documentation of relations between companies depends on establishing the correct role. If the counterparty is an authorized person, then the following must be stipulated in a separate agreement or in a section of the current agreement:

purposes of processing personal data(for example, photographing an event on May 5, 2026);
list of specific actions that will be performed with personal data by an authorized person(for example, collection by photographing, provision and cross-border transfer of ICPAO "YANDEX" when uploading finished photos to Yandex.Disk, storage for 1 month);
obligations to maintain the confidentiality of personal data(for example, not to disclose personal data without proper legal basis);
measures to ensure the protection of personal data in accordance with Art. 17 Personal Data Law(for example, involving sub-authorized persons with the written consent of the operator, issuing a policy regarding the processing of personal data, providing information on the procedure for processing personal data at the request of the operator within 5 working days).

Today we want to remind you of a few key points that are important to differentiate.

1. The operator organizes the processing of personal data, that is, the goals and deadlines, the volume of data processed, the circle of persons to whom personal data is provided.
For example, a company operating an online platform for training individuals organizes the processing of personal data. The processing itself is carried out by its contractors: payment service providers upon payment, cloud services, etc.

2. The operator processes personal data himself.
For example, an employer processes the personal data of its employees (full name, date of birth, passport data, education information, photograph, etc.) independently without the involvement of third parties. The procedure for processing personal data within the framework of labor relations is established by law.

3. The operator combines two forms: organization and processing of personal data.
For example, a medical center, when concluding an agreement with patients, processes their personal data (full name, passport data, blood tests, information about diagnoses, etc.), independently determining the volume and order of such data.

Let us remind you that co-operators are operators who organize and (or) carry out the processing of personal data, together with a common purpose and processing of the same amount of personal data.

For example, a joint loyalty program of two companies, when a consumer purchases a dress in a store and receives a coupon for a pizzeria (the name and email address are processed for the purpose of participating in the Taste & Style Club loyalty program).

Despite the fact that the law does not establish requirements for the agreement between co-operators, we recommend that it reflect the following: - Purposes of processing (for example, participation in the “Shared Path” loyalty program)
List of processed personal data (for example, collection by filling out an electronic form, providing the co-operator with the “name and UNP of the company”, storage for 1 year after receiving consent)
Rights and obligations of each co-operator
The procedure for considering applications of personal data subjects

Important!The policy regarding the processing of personal data must contain a reference to the co-processor.

A classic example of interaction would be “operator-to-operator”. This means that each person has their own interests and each person independently determines the key processing parameters. In such a situation, the legislation does not have specific requirements for establishing legal relations between such persons.
For example, the seller organization and the buyer organization indicate in the contract the name and email address of their employees as representatives. Each organization processes the data of the counterparty’s employees as an independent operator.

Thus, when analyzing legal relations, it is often really difficult to correctly determine the legal role and legal basis of processing. However, the contractual binding depends on its establishment.

Authors