Confusion over GDPR controller vs processor

[AnnieMcJohns]

Say company A hires company B to develop a piece of software and store all data associated with this software. Is company B a controller or processor? Or is company B a processor and depending on how it uses the stored data can be a controller as well?

 

[c1070]

Say company A hires company B to develop a piece of software and store all data associated with this software. Is company B a controller or processor? Or is company B a processor and depending on how it uses the stored data can be a controller as well?

From my understanding, as long as company B is using the data solely as instructed by company A, then it will be a processor. If company B does anything with the data beyond what it has been instructed to by company A, eg using the personal data collected for marketing of its own products, then it becomes a controller!
Fieldfisher have a useful YouTube series on data protection law: