Is a marketing agency a data controller or a processor?

The ICO's guidance on controllers and processors starts from a sentence that undoes most one-line contract clauses: an organisation is not by its nature either one. The role depends on the personal data and the processing activity, and on who decides the purposes and the manner of that particular activity. For a UK professional services firm, this means the agency's status can change within one engagement.

Below are five ordinary jobs an agency does for a firm of 10 to 50 people, each put through the ICO's test. The answers are not the same, which is the point. A master agreement saying that the agency is a processor can be right for several jobs and wrong for the one that matters.

The test the ICO applies

The ICO asks who decides, not who holds the data. Its page on how to determine whether you are a controller or processor lists the decisions that point to control: whether to collect the data at all, what types to collect and about whom, what it will be used for, whether to disclose it and to whom, and what individuals are told. A processor acts on behalf of a controller and on its instructions. The wider guide to controllers and processors gives the same split.

Being paid to provide a service does not settle it either. The ICO says that a supplier does not become a processor in every case just because it was hired, so the question has to be answered from the facts of each job. The statute backs the same reading from the other side: under Article 28(10) a processor that determines purposes and means is considered a controller for that processing, whatever the paperwork says.

A processor is not barred from every decision. The ICO's guide accepts that a processor can take day-to-day technical decisions, such as which system to use and how to store the data, and still remain a processor. Take the quarterly client email. The firm decides who receives it and why. The agency decides which sending tool carries it. The first set of decisions makes the firm the controller, and the second leaves the agency where it was.

The two rows where the answer turns

The fourth row is the one where a firm can give away control without noticing. If the firm tells the agency exactly whom to approach and why, the agency is following instructions. If the firm says only “find us more clients like these” and the agency chooses the sources and the people, the agency is deciding who is processed and for what. At that point the agency may be a controller, or the two may be joint controllers. For joint controllers, Article 26 requires a transparent arrangement that settles who is responsible for what, including how individuals exercise their rights.

The fifth row is the one a firm can prevent with one sentence. An agency that reuses client data to refine its own methods has chosen a purpose of its own. A firm may well not want that, and the sentence that stops it is a prohibition on using their data for anything but their own campaigns. Asking the question also surfaces something worth knowing about how a supplier works.

What to write down against each job

Four lines per activity turn the role from an assumption into a record. The same discipline that applies to counting what an enquiry is applies here: the firm that writes it down is the firm that can show what it told the agency to do.

What the firm stays answerable for

Handing a job to a processor does not hand over the responsibility for it. The ICO notes that controllers carry more obligations under the UK GDPR than processors, because they decide what is collected and why. That is the reason a firm must choose a processor carefully: Article 28(1) lets a controller use only a processor that provides sufficient guarantees. In practice a managing partner is answerable for the instruction given and the supplier chosen. Neither transfers to the agency because a proposal says it is compliant.

Questions to put to the agency before the first export

Four questions cost nothing and show how the supplier thinks about its own role. Ask which of the jobs in the table it expects to do, and for each one whether it will act only on the firm's instructions. Ask whether it uses other suppliers to do any of the work, since Article 28(2) bars a processor from engaging another processor without the controller's written authorisation. Ask what it does with the firm's data once the contract ends. Ask finally whether it has ever reused a client's data to improve its own methods. A supplier that has thought about these will answer in specifics. One that has not will answer in reassurance, and the difference is useful to know before any list changes hands.

A contract is needed, and it is not enough

Where the agency is a processor, the UK GDPR requires a written contract, and the firm has to choose a processor that gives sufficient guarantees. That is Article 28. The contract belongs to the roles above and cannot replace them. A clause that calls the agency a processor for everything will not protect a firm that has in fact left the choice of people to approach, or the reuse of its data, to the agency.

The commercial side deserves the same attention. A firm comparing which route finds a better agency can add one question to every shortlist: which jobs the supplier will do on the firm's instructions, and which it would decide for itself. Our own view of what an engagement should hold is set out for accountancy practices, recruitment agencies, tax advisory and financial advice firms.

The same question on other platforms

The test is the same wherever the agency holds an account for the firm. A social media account run for the firm raises the same split, and the access rules that decide who can do what on a LinkedIn Page show how a platform's own terms limit what a supplier may do before any data protection question arises. Settle the role and the access together, so that neither contradicts the other.

When not to spend time on this yet

Where the work touches no personal data, there is no role to determine. A logo or an edit of the firm's own copy, with nothing drawn from client records or enquiries, does not raise the question. The moment the agency receives a mailing list or access to visitor data, it does. Settling it then takes a short conversation. Settling it after a complaint takes a good deal longer.

This article is not a substitute for advice. A managing partner who is unsure how a particular job falls should ask the firm's data protection lead or solicitor, and a regulated firm should check what its own regulator expects. Saying so costs us nothing, because we are paid by the agency and only when a relationship works.