Controller or processor?

Answer:

Usually, medical service providers, as well as insurance providers, will be acting as independent controllers in regards to the data of your employees that are ultimately the beneficiary of the services. Although the EU GDPR does not require a formal addendum to be signed between the two, it is customary for the controller to have a document in place that regulates the way that the two controllers will be assisting each other.

If you want to find out more about controllers and processors check out our free EU GDPR Foundations Course (https://advisera.com/training/eu-gdpr-foundations-course//).

Thanks Andrei, very useful answer... as usual!