CCSP Legal, Risk, and Compliance Practice Question
A European retailer stores customer personal data in a cloud-hosted e-commerce platform. The cloud provider processes data only on documented instructions from the retailer, which determines the purposes and means of processing. Under the General Data Protection Regulation (GDPR), which role does the cloud provider hold?
⚠ Common exam trap
The trap here is assuming that owning or operating the underlying infrastructure automatically makes the cloud provider a controller rather than a processor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data processor, because it processes personal data on behalf of, and only on documented instructions from, the retailer.
The GDPR distinguishes controllers, who determine the purposes and means of processing, from processors, who act on the controller's behalf. The retailer decides why and how personal data is processed, while the cloud provider follows documented instructions, making it a processor. This triggers Article 28 obligations, including a mandatory data processing agreement and appropriate technical and organizational measures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Independent controller, because it makes technical decisions about storage locations and backup schedules.
Why it's wrong here
Technical decisions about infrastructure do not make a provider an independent controller. A processor may make operational choices while remaining bound by the controller's instructions. Independent controllership would require the provider to determine the purposes and essential means of processing, which is not the case in this arrangement.
- ✓
Data processor, because it processes personal data on behalf of, and only on documented instructions from, the retailer.
Why this is correct
GDPR defines a processor as a natural or legal person that processes personal data on behalf of the controller. Because the retailer sets the purposes and means and the provider acts only on documented instructions, the provider is the processor, and Article 28 requires a binding data processing agreement between the two parties.
- ✗
Data controller, because it operates the physical infrastructure where the personal data resides.
Why it's wrong here
Operating infrastructure does not confer controller status. Under GDPR, the controller is the entity that determines the purposes and means of processing. The retailer decides why and how customer data is processed, while the provider acts only on documented instructions, so infrastructure ownership is legally irrelevant to this determination.
- ✗
Joint controller, because both organizations participate in the processing activity.
Why it's wrong here
Joint controllership requires two or more controllers to jointly determine the purposes and means of processing. Here the provider does not determine purposes or means; it merely follows the retailer's documented instructions. Participation in processing alone, without shared determination, does not create joint controllership under GDPR.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.