GDPR Responsibilities define duties of data controllers and processors.

Key Points:
1) Controllers decide purpose
2) Processors handle data
3) Both must ensure security.

A hospital (controller) hires an IT provider (processor) to manage records, as taught in GDPR Training UK.