Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallResponsibility usually follows the organisation that decides why and how a particular personal-data use occurs—not automatically the AI developer, vendor, or customer. Under the UK Information Commissioner’s Office (ICO) controller-and-processor framework, an organisation that determines the purposes and essential means of processing is generally a controller. A provider acting only on a client’s documented instructions is generally a processor for that operation. One AI system can involve several organisations with different roles at different stages.
To identify responsibility, separate each activity—such as prompt handling, retention, evaluation, fine-tuning, training, deployment, and analytics—and map who makes the decisions for it. The applicable country’s law, the parties’ actual conduct, and the exact data flow all matter.
As an Amazon Associate I earn from qualifying purchases.
Why “reusing personal data” is not one legal activity
“Reuse” can describe several technically and legally different operations. A service may receive personal data in a prompt, store it for abuse monitoring, use selected records to evaluate a model, fine-tune a model for one customer, or add data to a general training process. Those operations can have different purposes, decision-makers, retention periods, and contracts.
The ICO explains that AI commonly processes personal data in several phases and for several purposes. Its guidance states: “As AI usually involves processing personal data in several different phases or for several different purposes, it is possible that you may be a controller or joint controller for some phases or purposes, and a processor for others.” That means a role assigned to one stage cannot safely be applied to the entire AI system.
Typical reuse stages to map separately
- Collection: obtaining records, images, audio, or text that identify or relate to people.
- Prompt and input handling: sending user content to a model, logging it, filtering it, or keeping it for support.
- Evaluation and safety testing: using examples to measure accuracy, bias, security, or abuse resistance.
- Fine-tuning: adapting a model to a customer’s domain or workflow.
- General model training: using data to improve a provider’s wider service or future models.
- Deployment and analytics: generating outputs, monitoring use, and analysing performance after launch.
This list is a practical way to break down a workflow, not a claim that every legal system assigns a fixed role to every stage.
Controller, processor, or joint controller?
The central question is who determines the purpose and the essential means of the processing. The ICO’s examples of overarching decisions include what data to collect, why to use it, whose data is involved, how long to retain it, and how to handle people’s rights requests. A contract is important evidence, but its labels do not override what the parties actually decide and do.
| Question | Indicators of controller status | Indicators of processor status |
|---|---|---|
| Why is the data being used? | The organisation chooses an independent purpose, such as improving its own general model. | The organisation has no purpose beyond carrying out the client’s documented purpose. |
| Who selects the data? | The organisation decides which sources or categories to collect for its own objective. | The client specifies the data and the provider follows those instructions. |
| Who sets retention and access rules? | The organisation makes overarching retention, access, or disclosure decisions. | The provider applies limits set by the controller and records them in instructions. |
| Who answers rights requests? | The organisation communicates with individuals and determines how requests are handled for its processing. | The provider assists the controller and follows the agreed procedure. |
| What happens if the provider makes a new use? | A self-chosen new purpose can make the provider a controller for that use. | Using the data only as instructed supports processor status for that operation. |
Controller
A controller decides the purpose and essential means. Under Article 24(1) of Regulation (EU) 2016/679 (the EU GDPR), “the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation.” Accountability therefore includes being able to show how decisions were made, not merely asserting compliance after an incident.
Rank #2
Processor
A processor handles personal data for a controller and on documented instructions. Under the EU GDPR, the relationship must be governed by a contract or other legal act covering matters such as the subject and duration of processing, the nature and purpose, the types of data, confidentiality, security, assistance with rights, deletion or return, and audits. The ICO also describes direct processor obligations and potential liability when a processor breaches those duties or acts outside lawful instructions. A processor is not responsibility-free simply because a customer chose the purpose.
Joint controllers
Two or more organisations can jointly determine purposes and means. EU GDPR Article 26 requires them to transparently set out their respective responsibilities, including how people can exercise their rights and which party provides information. The arrangement does not prevent an individual from exercising GDPR rights against each controller. Calling a relationship “joint” does not remove the need to identify each organisation’s actual decisions.
Is the AI company a controller or a processor?
It can be either, and it can be both for different operations.
Provider acting as a processor
Suppose a business instructs a hosted model provider to analyse its support tickets solely to answer customer queries. The business determines the purpose, permitted data, retention period, and access rules; the provider supplies infrastructure and follows those instructions. On those facts, the provider is likely to be a processor for the analysis and storage covered by the instructions.
Provider acting as a controller for its own reuse
If the provider independently decides to retain those tickets and use them to improve a general-purpose model, it has selected a purpose of its own. It may therefore be a controller for that reuse, even if it remains a processor for the customer’s instructed analysis. The provider must assess and document the status for each processing activity rather than rely on one label for the service as a whole.
Customer and provider sharing decisions
If both parties jointly decide which customer records to combine, why the combined set is needed, and how long it will be used for a shared model, joint-controller analysis may be appropriate. The answer depends on the actual decision-making arrangement, not on whether one party is called the “vendor” and the other the “client.”
Who is liable if an AI tool trains on customer data?
Liability follows the relevant operation and the duties that were breached. A customer that decides to submit personal data for training remains accountable for its own controller decisions, including the purpose, information given to people, retention, security, and response to rights requests. A provider that trains the data for an independent purpose may have controller duties for that training. If it was instructed not to train the data but does so anyway, acting outside instructions can create processor liability or shift the legal analysis for the unauthorised use.
The EU GDPR distinguishes controller accountability from processor duties. Article 24 requires controllers to implement and demonstrate appropriate technical and organisational measures. Article 28 requires processors to operate under documented instructions and a compliant contract. The ICO’s processor guidance also recognises direct obligations and liability for certain failures, including unlawful conduct beyond the controller’s instructions. A contract can allocate tasks and indemnities between organisations, but it cannot change the facts of who decided the purpose or eliminate statutory duties owed to individuals.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Can a vendor reuse data for its own AI training?
A vendor may be able to do so only after analysing the new purpose under the applicable law. The ICO says people should be informed if their data will be used to train an AI system. When data collected for one purpose is later used for AI training, the organisation must address whether the new use is compatible with the original purpose and tell individuals, subject to applicable exemptions and circumstances.
Best Value
- Updated Compliance: While the new rule takes effect on 7/19/2024, training and compliance dates don’t start until 1/19/2026, giving your team ample time to prepare with this thorough guide to OSHA regulations (29 CFR 1910.1200(j)).
- Comprehensive Safety Training Handbook: Prepares your employees for 25 of OSHA’s hottest safety topics, from Confined Space Entry to Workplace Violence, ensuring they are equipped with vital safety knowledge for a safer work environment.
- In-Depth, Easy-to-Understand Content: Each chapter tackles key workplace hazards like Electrical Safety, Lockout/Tagout, Respiratory Protection, and more, helping to prevent injuries and illnesses while promoting safe practices.
- Interactive Learning with Quizzes: Engaging chapter review quizzes reinforce safety concepts, making it easier for employees to retain and apply the knowledge, with downloadable answer keys for easy tracking.
- Specifications: English, Softbound, full-color pages (272 pages) offer clear, visually appealing safety information for a diverse workforce, with home safety details included throughout.
That analysis should identify the exact data, the training objective, the organisation making the decision, the retention period, and the safeguards. A broad statement that data may be used to “improve services” does not by itself establish which organisation is controller, whether the later purpose is compatible, or how people can exercise their rights. If the vendor chooses the training purpose, it should document its controller position for that operation and explain the arrangement clearly.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A practical method for assigning responsibility
Use the following sequence for every distinct data flow. It structures an assessment; it does not replace advice on the law of the country involved.
- Describe the data. List the fields, free text, images, recordings, identifiers, inferred information, and any sensitive categories. Decide whether the information is personal data under the relevant legal framework.
- Name the precise operation. Record whether the activity is collection, prompt handling, logging, evaluation, fine-tuning, general training, deployment, support, or analytics. Avoid the vague label “AI processing.”
- State the purpose in one sentence. For example, distinguish “answer this customer’s request” from “improve the provider’s general model.” Different purposes can produce different roles.
- Identify who decided why. Ask which organisation chose the purpose and whether another organisation independently changed it.
- Identify the essential means. Determine who selects data sources, retention, access, model-development settings, deletion rules, and the process for handling rights requests.
- Compare instructions with conduct. Check whether the contract and written instructions match what people actually do. A processor that begins an unapproved training use may no longer be acting only as a processor for that use.
- Map communication and rights handling. Record who tells people about the processing, receives requests, supplies information, and coordinates searches, deletion, correction, or objections where applicable.
- Record the jurisdiction and evidence. Note whether EU GDPR, UK GDPR, another regime, or multiple regimes apply. Keep the data-flow diagram, decisions, instructions, contracts, retention schedule, and role analysis together.
How responsibility changes across an AI lifecycle
| Lifecycle point | Questions to answer | Possible allocation |
|---|---|---|
| Data collection | Who chose the source, population, purpose, and retention period? | The collecting organisation is often controller; a collection service may be processor if it follows instructions. |
| Model development | Who decided that the records would train or evaluate a model, and for whose benefit? | The organisation pursuing its own model objective may be controller; a contractor following a customer’s specified development plan may be processor. |
| Fine-tuning | Who chose the adaptation objective and whether the resulting model is restricted to one customer? | Roles can differ between the customer’s adaptation purpose and a provider’s separate reuse for general improvement. |
| Deployment | Who determines the service purpose, user group, prompts, outputs, logging, and retention? | The deploying organisation may be controller for user-facing processing while the infrastructure provider is processor. |
| Support and analytics | Who decides to inspect logs, share them with subprocessors, or analyse them for a new objective? | The party choosing a new independent objective may become controller for that activity. |
Common mistakes and how to correct them
- “The contract says processor, so the issue is settled.” Compare the written role with actual decisions, especially independent retention, analytics, and training.
- “The model is one product, so it has one legal role.” Split the lifecycle into processing activities and document roles for each.
- “The customer supplied the data, so the customer is solely responsible.” Check whether the provider selected a separate purpose or used the data beyond instructions.
- “A processor has no direct duties.” Review processor obligations, security requirements, assistance duties, subprocessor controls, and liability provisions under the applicable law.
- “A privacy notice covering service delivery automatically covers training.” Explain the training purpose and assess compatibility when data is reused for a different objective.
- “Rights requests can be left until an incident occurs.” Decide in advance who receives requests, searches model-related records, coordinates responses, and records the outcome.
- “One country’s guidance answers every deployment.” Confirm the governing law. The ICO notes that its UK GDPR guidance is under review following the Data (Use and Access) Act, so verify the current UK position before relying on detailed guidance.
What a defensible record should contain
For each activity, retain a short role-assessment record containing the purpose statement, data categories, decision-makers, essential means, instructions, retention period, parties and subprocessors, rights-contact route, security measures, and jurisdiction. Explain why the provider is a processor, controller, or joint controller for that activity and identify any facts that could change the conclusion.
Recommended Free Tools
Review the record when the model, contract, retention setting, training policy, data source, or use case changes. A provider that initially processes prompts only on instructions may acquire a separate controller role when it introduces its own training, product-development, or analytics purpose.
Bottom line for organisations using AI
There is no universal answer that makes every AI developer responsible or every customer responsible. Responsibility is assigned activity by activity: find who decides why personal data is reused and the essential means, then apply the controller, processor, or joint-controller rules of the relevant jurisdiction. Treat contracts as part of the evidence, not as a substitute for examining actual conduct. For UK deployments, use the ICO’s current guidance with care while its materials are reviewed after the Data (Use and Access) Act; for EU deployments, apply the text of Regulation (EU) 2016/679, including Articles 24, 26, and 28.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
