What is a data processor?
Definition
A data processor is a person or organisation that processes personal data on behalf of a data controller, following the controller's instructions rather than deciding for itself why or how the data is used.
- Category
- Privacy
- Also called
- processor, GDPR processor
- Last updated
The definition comes from Article 4 of the GDPR: a processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. The controller is the one that decides the purposes and means of the processing. The processor does the work for them.
A simple example: an online shop (the controller) uses an email service to send order confirmations. The shop chose to collect your email address and decided what to send. The email service only stores and sends on the shop's instructions, so it is the processor. Payroll providers, cloud storage companies and customer support tools often play this role.
Why the split matters to you
When your data is misused, the controller is normally the one you deal with. If you want your data deleted or a copy of it, you ask the company that collected it, not the supplier behind it. The controller is then responsible for making sure its processors act on your request.
The label depends on what an organisation does with the data, not what it calls itself. A company that starts using your data for its own purposes, such as its own marketing, is acting as a controller for that use.
Data processor vs. data controller
- Controller: decides why and how your data is used. Usually the company you gave your details to.
- Processor: handles the data for the controller and only on its instructions.
- Data broker: usually neither in this sense. Brokers collect and sell data for their own purposes, which makes them controllers of what they hold.
How to protect yourself
- 1
Ask the controller, not the supplier
When you want your data deleted or a copy of it, send the request to the company you gave it to. Its privacy policy names a contact for data requests.
- 2
Read who it shares data with
Privacy policies usually list the processors a company uses. If the list is long or vague, give the company less of your data.
- 3
Give only what a service needs
Skip optional fields such as phone number and birthday. Data that was never collected can't be passed to a processor.
- 4
Remove the listings you didn't agree to
Brokers and people-search sites hold your data without any relationship with you. Serus finds the ones that list you where you live and sends the removal requests.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is a data processor responsible for a data breach?
Both can be. The GDPR places duties on processors as well as controllers, and a processor that has a breach has to tell the controller. The controller usually deals with the regulator and with affected people.
Can a company be both controller and processor?
Yes. A company can be a processor for one customer's data and a controller for its own customer and staff data. The role depends on the specific processing.
Who do I contact to delete my data?
Contact the controller, the company that collected your details. It is responsible for passing the request on to its processors.
Sources
Something wrong or out of date? Tell us and we'll re-check it.