Data Processor

A data processor is any person, public authority, agency, or other body that processes personal data on behalf of a data controller. Their role is limited to handling data according to the instructions provided by the controller, rather than determining the purpose or means of processing themselves.

Processor obligations typically include processing data only on written instructions, ensuring the confidentiality of the data, taking appropriate security measures, returning or deleting data at the end of the service, and assisting the controller with audits, breach notifications, and the individual or data subject rights requests.

The main difference lies in decision-making power. The data controller determines the purposes and means of processing (the why and how), whereas the data processor acts solely on behalf of the controller. The controller bears primary accountability for the lawful processing of the data.

A data processing agreement should detail the subject matter, duration, nature, and purpose of processing, the type of personal data, and the categories of the individual or data subject. It should also set out the processor's duties regarding security, confidentiality, sub-processing, and the rights and obligations of the controller.

A data processor can usually engage sub-processors only with the prior specific or general written authorization of the data controller. If allowed, the processor must impose the same data protection obligations on the sub-processor as are set out in the contract between the controller and the processor.

A data processor must implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. This can include encryption, pseudonymization where appropriate, ensuring the confidentiality, integrity, availability, and resilience of systems, and having the ability to restore data access in the event of a physical or technical incident.

Processor liability varies by jurisdiction and contract terms but commonly includes contractual liability to the data controller for failing to follow instructions or causing a breach. Depending on the applicable rules, processors may also face direct regulatory enforcement for failing to meet obligations such as security requirements or record-keeping.

To audit a data processor, the data controller should exercise the audit rights defined in the contract. This can involve reviewing the processor's independent assurance reports or certifications, inspecting relevant records of processing activities, and conducting assessments or third-party audits to verify adherence to agreed security and privacy controls. Many organizations manage this through a structured vendor review workflow (e.g., WatchDog Security's Vendor Risk Management) to centralize evidence like security questionnaires, DPAs, assurance reports, and re-assessment schedules.