This one's on the easy side. The company is the controller of the data, and Amazon is the processor. Here's Amazon's declaration and stance, stating they are

This one's on the easy side. The company is the controller of the data, and Amazon is the processor. Here's Amazon's declaration and stance, stating they are GDPR-compliant both as a company (when they are the controller - of their direct customers' data), as well as then they are a processor (infra for use by others who control private data): https://aws.amazon.com/compliance/gdpr-center/ https://aws.amazon.com/compliance/gdpr-center/ There's generally no need for a controller who relays data to a processor to understand the intricacies of the implementation on the processor's side (is deleted data really deleted ?) - what's more important is the processor's self-declaration for GDPR compliance. The above is my personal $0.02 as I've been spending quite some time getting into GDPR recently. IANAL