A data processor is a person, company, public authority or other body that processes personal data on behalf of a data controller, following the controller’s documented instructions rather than deciding the purposes of the processing itself. In privacy and data protection law, most prominently the GDPR, the processor is the party that carries out the work, while the controller decides why and how personal data is used.
Typical data processors include cloud hosting providers, payroll services, email delivery platforms, customer support outsourcers and analytics vendors. The role is defined by what an organization actually does with the data in a specific relationship, not by its size, its contract title or how it describes itself.
How the data processor role is determined
The data processor role is determined by who decides the purposes and essential means of processing. Under Article 4(8) of the GDPR, a processor processes personal data on behalf of the controller; under Article 4(7), the controller is the party that determines the purposes and means. The assessment is factual and relationship-specific.
A processor may still make non-essential decisions about means, such as which servers, software or security tools to use, as long as it does not decide essential means, such as which data is collected, for how long it is kept and who receives it. A processor that starts using the data for its own goals, for example to train its own products without a legal basis, becomes a controller for that processing under Article 28(10).
The following questions help classify a relationship.
| Question | Points to processor | Points to controller |
|---|---|---|
| Who decides the purpose? | The client organization | The organization itself |
| Who decides which data is collected? | The client | The organization itself |
| Can it use the data for its own goals? | No, only per instructions | Yes, within its own legal basis |
| Does it have a direct relationship with individuals? | Usually not | Often yes |
| Who answers data subject requests? | Assists the client | Responds directly |
Obligations of a data processor
A data processor has its own direct legal obligations under the GDPR, in addition to those set out in its contract. This was a significant change from earlier European data protection law, under which processors were bound mainly through contracts with controllers.
| Obligation | GDPR article | What it requires |
|---|---|---|
| Act only on instructions | Articles 28 and 29 | Process data only as documented by the controller |
| Security of processing | Article 32 | Appropriate technical and organizational measures |
| Records of processing | Article 30(2) | Register of processing done for each controller |
| Breach notification | Article 33(2) | Notify the controller without undue delay |
| Sub-processor control | Article 28(2) and 28(4) | Use sub-processors only with authorization and equal terms |
| International transfers | Chapter V | Lawful transfer mechanism outside the EEA |
| Data protection officer | Article 37 | Appoint one where the legal criteria apply |
Processors can be fined by supervisory authorities and held liable to individuals for damage, but under Article 82 a processor is liable only where it breached obligations aimed at processors or acted outside or against lawful instructions.
The data processing agreement
Article 28(3) of the GDPR requires a binding contract or other legal act, usually called a data processing agreement (DPA), between controller and processor. It sets out the subject matter, duration, nature and purpose of processing, the types of personal data and the categories of data subjects.
- Documented instructions, including on international transfers.
- Confidentiality commitments for everyone authorized to process the data.
- Security measures consistent with Article 32.
- Rules for sub-processors, either specific or general written authorization.
- Assistance with data subject rights, breaches and impact assessments.
- Deletion or return of data at the end of the service.
- Audit and information rights for the controller.
The European Commission has also adopted standard contractual clauses for controller-processor relationships, which organizations can use to satisfy Article 28 requirements without drafting every clause themselves.
Data processor compared with related privacy roles
The data processor sits within a set of roles that together describe responsibility in privacy fundamentals. Confusing them leads to wrong contracts, missing notices and unclear liability.
| Role | Decides purposes | Typical example |
|---|---|---|
| Data controller | Yes | A retailer running its customer database |
| Joint controllers | Yes, together | Two organizations running a shared campaign |
| Data processor | No | A hosting provider storing the retailer’s data |
| Sub-processor | No | A data center used by the hosting provider |
| Independent controller recipient | Yes, for its own use | A bank receiving payment data |
Outside Europe, similar roles exist under different names. California law uses service provider and contractor, and several other privacy laws use the term processor with comparable meaning, although the exact obligations differ by jurisdiction.
Common mistakes with data processors
The most frequent error is assuming that a vendor is a processor simply because it provides a technical service. Many advertising, analytics and social media tools use data for their own purposes as well, which makes them controllers or joint controllers for at least part of the processing.
- Missing DPAs with small vendors such as form builders or chat widgets.
- Unreviewed sub-processor lists that change without notice to the controller.
- Instructions left vague, so the processor effectively decides retention and use.
- Data minimization ignored when sending vendors more data than the service needs.
A non-technical view
A data processor is a company that handles personal information for someone else, following that organization’s instructions. The organization that decides what happens to the data is the controller. The processor simply does the agreed work.
Think of an accountant hired by a small business. The accountant works with the business’s records but does not use them for personal projects. The business decides what needs to be done, and the accountant follows those decisions and keeps the records safe.
A concrete example
An online clothing store uses an external email delivery platform to send order confirmations and newsletters. The store decides which customers receive which emails and for how long their addresses are kept. The email platform stores the addresses and sends the messages, so it acts as a data processor.
The store signs a data processing agreement that limits the platform to sending the store’s emails, lists its sub-processors and requires breach notification without undue delay. When the platform later announces a new feature that would use customer engagement data to improve its own benchmarking product, the store’s privacy lead recognizes that this would make the platform a controller for that use. The store opts out, keeping the relationship within the agreed instructions.