Privacy Glossary

Data Processor

An entity that processes personal data on behalf of and under the instructions of a Data Controller.

GDPRLGPDPDPA

Full Definition

A Data Processor is a person or organisation that processes personal data on behalf of a Data Controller, under their instructions, and for their purposes. Common examples include cloud service providers, payroll processors, email marketing platforms, and analytics vendors. Processors must only act on documented instructions from the controller, implement appropriate technical and organisational security measures, and support the controller in fulfilling data subject rights. Controllers are required to bind processors contractually through a Data Processing Agreement (DPA). Under GDPR, processors also have direct obligations, including breach notification.

How each law treats it

GDPRArticle 4(8) + Article 28

Processes personal data on behalf of the controller. The Article 28 DPA is mandatory and the processor remains liable for the sub-processors it engages.

DPDP Act§ 2(k)

'Data Processor' processes personal data on behalf of a Data Fiduciary. The Fiduciary remains accountable for the Processor's acts and omissions.

CCPA/CPRA§ 1798.140(ag)

'Service provider' is the processor-equivalent. Specific contractual clauses are mandatory under § 1798.140(ag).

In practice

A processor acts only on documented instructions. Any processing outside the instructions triggers controller status for that specific processing.
Processors must assist the controller with DSR fulfilment, breach notification, DPIAs and compliance audits.
Sub-processor transparency is the single most-asked due-diligence item in enterprise deals.

Common pitfalls

Processors assuming they inherit all the controller's rights to use the data. The DPA constrains them strictly.
Signing DPAs that don't specify the processing — the categories of data, data subjects, purposes and duration must be stated in writing (GDPR Article 28(3)).
Confusing 'sub-processor' with 'onward recipient'. A sub-processor is engaged by the processor; an onward recipient receives data under a separate controller relationship.

Frequently asked questions

Can a processor use the data for its own analytics?+

Not under the controller relationship. If the processor wants to use the data for its own purposes (product improvement, security research), it must switch role to controller for that specific processing, with its own lawful basis and notice.

What makes a processor liable directly to a data subject?+

GDPR Article 82 permits direct action against processors for damage caused by processing where the processor acted outside instructions or breached the processor-specific obligations in Articles 28 and 32.

Do intra-group processors need a DPA?+

Yes. Group companies are separate legal persons; the data-sharing between them requires an Article 28 DPA (or Article 26 joint-controller arrangement if they jointly determine purposes).

Back to all terms