Data Processor

A Data Processor is a person or organisation that processes personal data on behalf of a Data Controller, under their instructions, and for their purposes. Common examples include cloud service providers, payroll processors, email marketing platforms, and analytics vendors. Processors must only act on documented instructions from the controller, implement appropriate technical and organisational security measures, and support the controller in fulfilling data subject rights. Controllers are required to bind processors contractually through a Data Processing Agreement (DPA). Under GDPR, processors also have direct obligations, including breach notification.