DataTerminology.comNEW
Entity that processes personal data on behalf of, and under the instructions of, a controller.
DESCRIPTION
A Data Processor acts on instructions from a controller to process personal data, implementing appropriate security and assisting with obligations like rights requests and breach notifications. Processors must maintain processing records, ensure sub-processor controls, and notify controllers of incidents. Contracts define scope, instructions, and safeguards. Misclassification can transfer liabilities unexpectedly.
ALTERNATIVE DEFINITIONS
EU GDPR (Regulation (EU) 2016/679)
‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Legal definition focusing on processing on behalf of the controller.
UK Information Commissioner’s Office (ICO)
The processor acts on behalf of, and only on the instructions of, the controller.
Highlights dependence on controller’s instructions and limited autonomy.
RELATED TERMS
Sub-processor Data Processing Agreement Data Protection Officer Data Subject Access Request Right to be Forgotten Joint Controller Security Measures Records of Processing Activities Breach Notification
COMPETING TERMS
Data Controller
KNOWLEDGE AREAS
Data Privacy & Compliance Data Governance Data Management
TARGET AUDIENCE
Chief Information Officer Chief Technology Officer Data Governance Manager Data Steward Data Management Consultant Data Engineer
EXTERNAL SOURCES
- Wikipedia - General Data Protection Regulation
- European Data Protection Board - EDPB guidance on processor concept
- ICO - Controllers vs processors explanation
TOP QUESTIONS
What are a Data Processor’s core obligations?
Follow documented instructions, implement security, assist with rights and DPIAs, maintain records, and support audits.
Category: Compliance
Can a Data Processor decide the purposes of processing?
No. If it determines purposes or essential means, it may become a controller for that processing.
Category: Misunderstanding
How should sub-processors be managed by a Data Processor?
Obtain authorization, flow down obligations, assess security, and notify changes to controllers.
Category: Management
What constitutes processing on behalf of a controller?
Actions like storage, transmission, analysis, or deletion performed under the controller’s instructions and contract.
Category: Concept
What happens if a Data Processor violates instructions?
It may assume responsibilities akin to a controller for the violation, increasing liability exposure.
Category: Risks
Do processors need Records of Processing Activities?
Yes, most processors must keep records of processing categories carried out on behalf of controllers.
Category: Documentation
How do processors handle data breaches?
They must notify controllers without undue delay, providing details to support regulatory notifications.
Category: Process
How can a processor demonstrate compliance?
Provide audit reports, certifications, logging, and evidence of controls, plus transparent sub-processor lists.
Category: Audit
What are common mistakes processors make?
Insufficient data mapping, unclear sub-processor chains, and inadequate incident response communication.
Category: Mistakes