GDPR & Approval Software: What Processing Looks Like
Under GDPR, your organization is the Data Controller — deciding what's processed and why — and the approval platform is the Data Processor, acting on your instructions. The split decides who answers for what.
Approval workflows process personal data: names, emails, job titles, actions attributed to individuals. For UK/EU organizations, the processing needs a legal footing and a paper trail. This page maps the obligations. It's guidance, not legal advice — your DPO or counsel makes the final call.
The controller/processor split in practice
| Question | Who answers |
|---|---|
| Why is this data processed? | Controller — your organization |
| Who has access, where is it hosted? | Processor — the platform, under contract (the DPA) |
| A data subject demands their data? | Controller decides; processor exports |
| A breach occurs? | Processor notifies the controller fast; controller notifies the authority within 72 hours |
What to demand from a vendor
- A Data Processing Addendum — the contract that formalizes the processor role
- Legal bases baked in — approval processing typically runs on contract performance and legitimate interest; marketing data on consent
- Export on request — a subject's data, complete, on demand
- Deletion that's real — live removal immediately, backup purge on a stated window
- Breach notification inside 72 hours — processor to controller, in writing
The full security context behind these promises: the security model and the evidence layer.
Frequently Asked Questions
Is an approval platform a controller or processor?
Processor for your operational data — acting on your instructions; controller only for its own account and billing records.
What legal basis covers approval workflows?
Usually contract performance (running the service you're paying for) and legitimate interest (security monitoring, fraud prevention) — documented, not assumed.
Approvdit operates as Data Processor with a DPA available on request, 30-day deletion windows, and 72-hour breach notification. Book a live demo.