Data processor

What it means

Under the GDPR, a processor is a company or person that processes personal data on behalf of a controller and according to its instructions. It does not decide the purpose of processing itself but only carries out the work the controller has entrusted to it.

Typical processors are accounting firms and payroll services, hosting and cloud service providers, CRM or email marketing vendors, IT support with access to company systems, and document shredding companies. Every company has several such processors.

The relationship between controller and processor must be governed by a written data processing agreement. It sets out the subject, duration, nature and purpose of processing, the types of data, the processor’s security and confidentiality obligations and what happens to the data when the cooperation ends.

How it works in practice

As an accounting firm, we act as processor for clients when handling payroll and accounting documents containing personal data. We therefore sign a data processing agreement with every client that clearly states what we do with the data and how we protect it.

When reviewing a client’s data protection, we list all their processors and check that an agreement exists with each. With large cloud providers the agreement is usually part of the terms of service, but it is necessary to check where the data are stored and whether they are transferred outside the EU.

A processor may engage a sub-processor, such as a data centre, only with the controller’s consent. The controller should have an overview of the whole chain and list the recipients in its record of processing activities.

What to watch out for

The most common mistake is using services without realising they involve processing, such as free online tools or apps used by staff. Such shadow IT means processing without an agreement and without control over where the data end up.

A processor that starts using data beyond its instructions, for example for its own marketing, becomes a controller to that extent and breaks the law. The controller should therefore reserve the right to inspect and audit in the agreement.