Data controller vs processor in booking systems

When your customers book appointments online, your business is the data controller for their personal data, because you decide why and how it is used. The booking system provider is the data processor: it stores and processes the data on your behalf and on your instructions. The relationship is governed by a Data Processing Agreement.

What is a data controller?

The data controller is the one who determines the purposes and means of processing personal data (GDPR Article 4(7)). For a salon or clinic, this means the business decides what information customers must provide when booking, how long it is stored, and what it is used for.

As a data controller, you must, among other things:

• inform customers about how their data is used, for example in a privacy policy
• have a lawful basis for processing, such as a contract for the booking itself and consent for marketing
• respond to access and deletion requests, as a rule within one month
• choose providers that offer sufficient guarantees for security

Read more in Klarte's guide to your responsibilities as a data controller.

What is a data processor?

A data processor processes personal data on behalf of the data controller (GDPR Article 4(8)). The processor may not use the data for its own purposes. It must keep the data secure, use only approved sub-processors and help the controller with, among other things, access requests.

Data controller vs data processor: the difference in brief

• Who decides? The controller decides the purposes and means. The processor follows instructions.
• Who responds to the customer? The controller responds to access requests. The processor assists.
• Who must have an agreement? Both. GDPR Article 28 requires a Data Processing Agreement between them.
• Example: The salon is the data controller. The booking system is the data processor.

The same company can hold both roles for different data. Klarte, for example, is the data controller for information about its own account owners, but the data processor for information about the customers who book with the businesses.

What should a Data Processing Agreement contain?

The agreement should describe which data is processed, for what purpose, for how long, how it is secured, and which sub-processors are used. It should also state what happens to the data when the agreement ends. See Klarte's Data Processing Agreement and the list of sub-processors.

Checklist for businesses that take bookings online

1. Sign a data processing agreement with your booking provider.
2. Check where the data is stored. Klarte stores data in the EU.
3. Only ask for the information you need to carry out the appointment.
4. Keep marketing consent separate from the booking itself.
5. Have a routine for handling access requests.
6. Don't write health information or other sensitive information in booking notes unless you have a legal basis for doing so.

This article is general information and not legal advice. For specific questions, contact a lawyer or your data protection authority. See also the definitions in the glossary.