What is a data processor under GDPR?
Definition
Data processor (GDPR) means a person or organisation that processes personal data on behalf of a data controller. Under Article 4, the processor follows the controller's purposes and doesn't decide them.
- Category
- Privacy
- Also called
- GDPR processor, processor
- Last updated
The GDPR defines a processor in Article 4 as a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller. The controller is the one that decides why and how the data is used. The processor does the work for it.
"Processing" is broad. Article 4 lists collection, storage, retrieval, use, disclosure, combination and erasure, among others. So a company that only stores or sends data for someone else is processing it.
An example
A shop uses an email service to send its newsletter. The shop chose to email its customers and picked the list, so the shop is the controller. The email service sends the messages for the shop, so it's the processor. If the email service started using the same list for its own marketing, it would be deciding its own purposes, and it would no longer be acting only as a processor.
Processor vs. controller
- Controller: decides the purposes and means of the processing, alone or jointly with others.
- Processor: processes data on the controller's behalf.
The same company can be a controller for some data (its own staff records) and a processor for other data (a customer's files it hosts).
Why it matters to you
When you ask a company what it holds about you, the controller is who you deal with. Processors sit behind it: cloud hosts, payroll providers, email tools. Your data can pass through several of them without you ever dealing with them directly.
How to protect yourself
- 1
Find out who the controller is
A company's privacy notice should say who decides how your data is used and how to contact them. Send access or deletion requests there.
- 2
Ask about who else gets your data
In an access request you can ask which recipients your data was disclosed to. That often shows the processors involved.
- 3
Share less to begin with
Fewer details given on sign-up forms means fewer details passed along to every processor in the chain.
- 4
Check what brokers list about you
Companies that sell personal data are controllers in their own right. Serus finds the data brokers that operate where you live and removes your listings for you.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is a data processor the same as a data controller?
No. The controller decides why and how personal data is used. The processor handles it on the controller's behalf.
Can a company be both a controller and a processor?
Yes. It can be a controller for its own data, such as employee records, and a processor for data it handles for a customer.
What counts as processing under GDPR?
Article 4 lists operations such as collecting, storing, using, disclosing, combining and erasing personal data, whether or not it's done automatically.
Sources
Something wrong or out of date? Tell us and we'll re-check it.