Who is controller, who is processor, and why the agency is in the chain
Regulation (EU) 2016/679 distinguishes the controller, which decides the purposes and means of processing, from the processor, which processes personal data on its behalf. Your client, who runs a site, a shop or a newsletter, is generally the controller. As soon as you host, administer or back up that site, you process that data for the client: the agency then usually acts as a processor. The host, the email provider or the backup service you use in turn work for you. They are the agency's sub-processors, and they should act only with the client's written authorization.
The qualification is not chosen at will. The CNIL reminds us that the principal and the provider analyze their roles together, based on what each actually does with the data. An agency that reuses a client's data for its own needs, for example its prospecting, becomes a controller for that use alone. The common objection, "this is the host's problem", forgets that the chain runs through you: the client questions the agency, and the agency must know which links it added.
Roles in the chain, from client to host
Scroll the table
| Party | Most frequent role | What it owes the party above |
|---|---|---|
| End client (site, shop, newsletter) | Controller | Give written instructions and choose providers knowingly |
| Agency that hosts, maintains or backs up the site | Processor for the client | A processing agreement, the list of its own processors and where they process |
| Host, server provider | Agency's sub-processor | An equivalent agreement, described security measures, information on its own providers |
| DNS provider, registrar | Sub-processor, depending on the data handled | Handle records and query logs according to your instructions |
| Mail service, off-site backup | Sub-processor | Encryption, retention period, deletion on exit |
| Agency reusing the data for itself | Controller, for that use alone | A legal basis and information to individuals, independent of the client contract |
The day the client asks for the list
The scenario is ordinary. The client prepares an audit, answers a tender or fills in a large customer's questionnaire, and asks for the agency's processors with the matching agreement. Without a register, the agency rebuilds from memory: the server is at one host, the mailboxes at another, the backup in storage created one night during an outage, the DNS at the original registrar. This rushed work takes days and leaves gaps. An up-to-date register fits on one shared sheet plus one sheet per client, and can be produced in minutes. It also serves the agency itself: the day of a vulnerability or a leak, you know where to look and whom to warn.
The register columns
The register does not need a specialized tool. A shared spreadsheet, readable by the clients concerned and writable by two people at the agency, is enough to start. Keep one row per service and per client rather than one row per provider: the host of a thirty-site portfolio is a single provider, but thirty distinct data scopes. Here are the columns to plan.
Seven columns are enough
- Service — the provider and the service: server hosting, DNS, mailboxes, off-site backup, monitoring.
- Role — controller, processor or sub-processor, from the agency's point of view and for this specific service.
- Data concerned — categories of data and individuals: shop customer accounts, contact forms, mailboxes, access logs.
- Location — country and processing site, backups included, and any remote access by a provider located outside the Union.
- Contractual basis — the processing agreement, its terms or addendum, with the version and the location of the signed document.
- Review date — the day of the last check and of the next: a register without a date does not say whether it is still true.
- Contact — the person or address at the provider to reach for a request, an incident or an audit question.
Services to list for a client site
The trap is listing only the host, because it is the one paid every month. Yet a client site sends data to many more places: the DNS zone, the mail service, the backup you connected, the tool that receives alerts, the service relaying traffic, the scripts loaded from a third party. Each can see IP addresses, email addresses or form contents. The list below is a starting grid; add whatever else your stack contains.
Eight service families to review
- Hosting — shared server, VPS or dedicated, and the hypervisor or region behind it.
- DNS — the host of the zone, which may differ from the domain name registrar.
- Email — the client's mailbox service, transactional sending relay, spam filter.
- Off-site backup — the remote storage, its encryption and retention period.
- Monitoring — the tool receiving logs and alerts, often hosted elsewhere than the site.
- CDN and WAF — the service relaying traffic sees IP addresses and sometimes request contents.
- Analytics tools — audience measurement, maps, fonts and scripts loaded from a third party.
- Application services — payment, forms, newsletter, chat, plugins that send data to their publisher.
Map a site in eight steps
Identify the domain and DNS zone
Find the registrar and the name servers:
whois your-domain.comthendig +short NS your-domain.com. Note who holds the zone and who can change it.Find the host
dig +short A your-domain.comgives the site address, andwhois 203.0.113.10(replace with the address you got) shows the network carrying it. If a CDN sits in front, the address is its own: ask the client for the origin or read it in your hosting panel.Read the mail service and senders
dig +short MX your-domain.comnames the receiving service.dig +short TXT your-domain.comshows the SPF record, which lists services allowed to send for the domain: newsletter, invoicing, forms.List third-party resources the site loads
Open the site with the browser's Network tab and sort by domain, or run
curl -s https://your-domain.com | grep -o 'https://[^"]*' | sort -u. Each third-party domain is a candidate row.Inventory backup and monitoring
On the server,
crontab -landrclone listremotesshow where copies go. Add the monitoring agents and alert services you installed yourself.Review plugins and integrations
For WordPress,
wp plugin listgives the plugins; for another stack, read the dependency file. Keep those that send data outside.Fill in the register and qualify each row
For each service, state the role, the data, the location and the contact. Whatever you cannot fill in becomes a written question to the provider.
Attach the agreement and set the review
Tie each row to its contract document, its version and the next review date. A row with no agreement stays flagged orange until one is obtained.
Points of a processing agreement to check
An agreement is not signed with eyes closed, and it is not a box ticked in a client panel. For the host, the DNS or the backup, check that the document covers the seven points below. We cite no article of law here: the CNIL publishes a processor guide and a sample of clauses, to read with your counsel. If a point is missing, do not infer it from the contract's silence: ask in writing and keep the answer with the register row.
What the agreement must cover
- Subject and nature of processing — what the provider does with the data, for what purpose, on which categories of data and individuals.
- Duration — the processing period, which in principle follows the service contract.
- Documented instructions — the provider processes only on written instruction and flags any instruction it thinks breaches the rules.
- Security — described technical and organizational measures, confidentiality of authorized staff, incident notification.
- Sub-processors — general or specific authorization, a communicated list, prior notice of any change and a right to object.
- Return or deletion — handing back or erasing the data at the end of the service, with a deadline and proof.
- Audit and assistance — information to demonstrate compliance, possible audits, help answering requests from individuals.
Keep the evidence next to the row
For each provider, keep a link to the signed document, the acceptance date if the agreement is accepted online, and a copy of the sub-processor list it publishes. When that provider changes its list, the register row is reviewed the same day, not at the next deadline.
Tying the register to clients and to a review rhythm
Keep the register on two levels. A shared sheet describes each provider once: agreement, location, contact, list of its sub-processors. One sheet per client shows which services touch its data and what scope they cover. When a client asks for its list, you extract its rows without rebuilding anything. Set a review at a regular pace, for example every quarter, and a review triggered by any change: new provider, server migration, new plugin calling an external service. The monthly audit of a client VPS and the restore test of a backup are good moments to spot these gaps, because you already look at what actually runs.
What a single provider changes in the register
Each service taken from a separate party adds a row, an agreement to collect, a contact to maintain and a sub-processor list to follow. Grouping domain, hosting and DNS with one provider mechanically reduces the number of rows and what remains to reread. There is a counterpart: dependence on a single supplier is also noted in the register, with how to leave if needed. On ServOrbit.com, the pages /pourquoi/securite and /pourquoi/infrastructure describe what we operate and where. They do not replace a contractual document and this article claims no certification: to obtain the documents of a specific service, write to [email protected] stating the scope concerned.
Three actions this week, and the official sources
Create the spreadsheet with the seven columns. Fill it in for the client whose data is most sensitive, using the eight mapping steps. Then send a written request to each provider whose agreement or sub-processor list is missing. For reference texts, rely on official sources: the CNIL processor guide (https://www.cnil.fr/fr/reglement-europeen-sur-la-protection-des-donnees-un-guide-pour-accompagner-les-sous-traitants), its page on the processor (https://www.cnil.fr/fr/qualification-juridique-sous-traitance) and the regulation text on EUR-Lex (https://eur-lex.europa.eu/eli/reg/2016/679/oj). This article is a practical guide and is not legal advice: have your agreements and qualifications validated by a legal professional.
