Spain Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) Art. 33: Treat a processor that acts in its own name or uses data for its own ends as a controller; settle data return at contract end

What does Art. 33 require?

Article 33: processor access to data needed to serve the controller is not a disclosure if the GDPR and this law are met; whoever deals with data subjects in its own name without showing it acts for another is a controller even with an Article 28.3 contract (except public procurement), as is a processor that uses data for its own purposes; the controller decides whether data are destroyed, returned or passed to a new processor at the end, returned where law requires retention; the processor may keep data blocked while liabilities may arise; public sector processing roles may be assigned by regulation.