What is a data processor?
A data processor is a separate organization that handles personal data for a data controller and on its instructions. Under GDPR, processing covers almost anything done with personal data, including collecting, storing, analyzing, sending and deleting it, so the term reaches far: a payroll service, a cloud email or CRM platform, a call center, an analytics vendor and a document-shredding company can all be processors. The processor carries out the work; the controller decides what the work is for.
A company's own IT department is not a processor. Staff inside the controller act as part of it, which is why an internal database administrator is described as a data custodian instead.
The processing contract
GDPR Article 28 requires a binding contract between controller and processor, usually called a data processing agreement (DPA). It has to describe the subject, duration, nature and purpose of the processing and the types of data and people involved, and it must commit the processor to:
- process the data only on the controller's documented instructions;
- bind its staff to confidentiality and apply appropriate security;
- engage subprocessors only with the controller's prior written authorization;
- help the controller respond to data subjects' requests, breaches and impact assessments;
- delete or return the data when the service ends;
- provide the information the controller needs to verify compliance, and allow audits.
Subprocessors
A subprocessor is a third party the processor hires to do part of the work, such as the cloud provider hosting a SaaS application or a service that sends its text messages. Authorization can be specific to one subprocessor or general, in which case the processor must announce planned changes so the controller can object. The processor must pass the same data protection obligations down to each subprocessor by contract and stays fully liable to the controller for the subprocessor's failures. Many SaaS vendors publish their subprocessor lists for this reason.
Example: a scheduling platform
A group of dental clinics in Europe uses a SaaS appointment system. The clinics are the controller, the SaaS company is the processor, and its cloud host and SMS reminder service are subprocessors. When the SaaS company detects that an attacker reached appointment data, it must inform the clinics without undue delay so they can meet their own reporting duty. If the company later decides to mine appointment data to sell insights to insurers, it is no longer acting on instructions, and GDPR treats it as a controller for that processing, with all the duties that brings. In the United States, the comparable health care arrangement is a HIPAA business associate working under a business associate agreement.
Data processor vs. controller and custodian
The quick test is who decides. The controller decides why personal data is processed and what is collected; the processor follows instructions. A custodian is an internal role that implements the owner's decisions on the organization's own systems, while a processor is a separate legal entity under contract. A processor also has direct obligations of its own under GDPR, including security, records of its processing and, in some cases, appointing a DPO, and regulators can fine processors directly.
Data processor on the CompTIA Security+ exam
Data roles fall under SY0-801 objective 3.3, which covers knowing what data an organization holds and how it is protected, and SY0-801 adds the subprocessor as a role. Wording such as "processes payroll on behalf of the employer", "acts only on the customer's instructions" or "a vendor that stores data for the company" points to a data processor, and "a third party hired by the processor" points to a subprocessor. Distractors include the data controller, which decides the purpose; the data custodian, an internal IT role; and the data owner.