Processors and data controller responsibility under the LPrD

A Vaud public entity remains responsible for data processing even when it delegates to a processor, such as an IT host, software vendor, or cloud service provider. It must govern this relationship by contract and verify the guarantees offered.

The use of external providers is widespread in municipalities, from school management software to cloud hosting. Each processor represents a risk point: the entity must identify its processors, formalise data protection obligations in contracts, verify data location, and monitor compliance over time. Processor management becomes a central compliance checkpoint under the LPrD.