A business example
A retailer decides to collect customer contact details for deliveries and instructs a software provider to store them.
Purpose decision
The retailer decides why the information is collected.
Processing design
The retailer determines relevant means and instructs its provider.
Vendor role
The provider performs the agreed processing on the retailer's behalf.
What this shows
Using hosted software does not automatically move the retailer's decision-making role to the vendor. Assess each activity and relationship.
What it is often confused with
Using a vendor does not necessarily transfer the retailer's own role or responsibility.
What to look at in your business
Record who determines each processing purpose and how vendors are instructed.
Context and further reading
MeitY: Digital Personal Data Protection Act, 2023. This reference supports the terminology; use the linked guide for applicability and operative requirements.
Kosha.Services · Updated 2 October 2026