Ask HN: GDPR for CMS SaaS app?

2 pointsgoing_to_8008y ago2 comments

Let's say you have a SaaS where your customers can create mini-websites which have sign up pages, members area, etc.

MY question, what is the SaaS for the data of those users who sign up on the customers' "mini-portals"?

Is it a processor or a controller? The SaaS customer can customize pages, send emails etc...so it looks like the controller is the customer and the SaaS is just the processor, but after talking with some lawyers I'm not so sure about that.

What do you think?

2 comments

2 comments · 2 top-level

smel8y ago

Both I think you're responsible for your scope and also customers if they have access to APIs or export feeds.

Any data about final users should be available and controlled via consentement mgt ui

termsfeed8y ago

This ICO guide can help know the difference between the data controller and the data processor:

https://ico.org.uk/media/for-organisations/documents/1546/da...

j / k navigate · click thread line to collapse