Identity data: controller and processor roles

Identity ecosystems cannot assign one GDPR role to a company for every activity. Determine who decides purposes and essential means for each operation: onboarding, fraud intelligence, model improvement, credential issuance, presentation, support and retention.

For: privacy, legal, procurement, wallet and identity-architecture teams. This is independent information, not legal, compliance or security advice.

Operation-by-operation map

Operation	Role question
Service onboarding	Who decides why identity is checked and which evidence is required?
Vendor verification	Does the provider follow documented instructions or set independent purposes?
Fraud network	Who decides to reuse signals across customers?
Model improvement	Who decides whether captures train or evaluate models?
Credential issuance	Who determines issuance and attribute purposes?
Wallet presentation	Who requests data and who operates each exchange component?

Evidence needed

• Architecture and data-flow diagrams.
• Product configuration and instruction controls.
• DPA, terms, privacy notices and subprocessor list.
• Purpose and retention for fraud/model datasets.
• Independent support, security and legal obligations.

Shared responsibility

Different organisations can control connected operations without becoming joint controllers for everything. Conversely, a provider with independent purposes may not be a pure processor merely because the contract says so. Record the reason for each classification.

Operational consequences

Assign transparency, data-subject requests, correction, deletion, incident notice, DPIA support, audit and regulator engagement. Test whether the process works across subprocessors and at contract exit.

Evidence and limits

MyID separates enacted rules, official implementation material, testing and vendor claims. A source can establish what its publisher says; it does not prove that every product, deployment or interpretation works as claimed. Where Irish implementation remains unsettled, this page says so.

• General Data Protection Regulation
• Data Protection Commission
• Government Digital Wallet data privacy notice

Sources checked 22 August 2026. Re-check the linked primary material before making a consequential decision.

Next useful pages

• Vendor due diligence
• Retention and deletion
• DPIA questions