GDPR Article 28(10): a processor that decides purposes becomes a controller (Regulation (EU) 2016/679, Art 28(10))
A processor that licenses customer data for AI training takes on controller duties for that use and infringes the GDPR by doing it without authority. A holder must first work out which records are its own and which belong to its customers.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing.”
Where it was read
Also read from the same source
- GDPR Article 5(1)(b): purpose limitation (Regulation (EU) 2016/679, Art 5(1)(b))
- GDPR Article 6(1)(f): legitimate interests as a lawful basis (Regulation (EU) 2016/679, Art 6(1)(f))
- GDPR Article 6(4): compatibility test for a new purpose (Regulation (EU) 2016/679, Art 6(4))
- GDPR Recital 50: further processing and the legal basis (Regulation (EU) 2016/679, recital 50)
- GDPR Article 9(1): special categories of personal data (Regulation (EU) 2016/679, Art 9(1))
- GDPR Article 13(3): telling people before a new purpose (Regulation (EU) 2016/679, Art 13(3))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides