Glossary
Processor
A person or body that processes personal data on behalf of the controller, under its documented instructions (GDPR Article 4(8)).
Article 4(8) GDPR defines a processor as a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. Typical processors include SaaS providers, cloud hosting providers, managed security service providers and outsourced IT support. Article 28 requires a binding contract setting out, among other things, that the processor acts only on documented instructions, keeps staff under confidentiality, applies Article 32 security measures, assists the controller, and deletes or returns data at the end of the service.
Processors have direct obligations too. They must implement appropriate security under Article 32, keep records of processing under Article 30(2), notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)), and use sub-processors only with the controller's prior written authorisation (Article 28(2)). Under Article 28(10), a processor that determines the purposes and means of processing itself is considered a controller for that processing.
For security and IT teams, processors are part of the supply chain attack surface. Vendor due diligence, contractual audit rights and breach notification clauses are where GDPR and security meet. See our guide to Article 28 processor contracts.