Organisation that processes personal data on behalf of a data controller.
A data processor processes personal data on behalf of a controller—they don't determine purposes but act on controller instructions. Cloud providers, payroll services, and marketing platforms are often processors. GDPR requires written contracts between controllers and processors specifying processing scope and requirements. Processors have direct GDPR obligations including security measures and breach notification. Many organisations are both controllers (for some data) and processors (for client data).
Why It Matters
The DSC Perspective:
If you handle client data under their instructions, you're likely a processor with specific GDPR obligations. Ensure contracts clearly define controller/processor relationships and requirements.