Data Processor
Definition under Article 4(8) GDPR — a service provider that processes on behalf of another
TL;DR
A data processor under Article 4(8) GDPR is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller. The relationship is governed by a DPA under Article 28.
What is a data processor?
Typical data processors:
- IT hosting providers (AWS, Azure, GCP, Hetzner)
- Cloud software (Microsoft 365, Salesforce, HubSpot)
- Newsletter tools (Mailchimp, Brevo, CleverReach)
- Payroll service providers
- IT maintenance with access to data
NOT data processors:
- Tax advisers (BayLDA 2024 — controllers in their own right)
- Banks (own statutory obligations)
- Postal dispatch (technical delivery)
Practical example
Practical example — a mechanical engineering firm with 30 staff has the following processors:
- Microsoft (M365 hosting) — DPA in place
- Mailchimp (newsletter) — DPA + DPF guarantee
- HubSpot (CRM) — DPA in place
- External payroll accountant — DPA (where qualifying as a processor)
- IT systems house (maintenance) — DPA in place
Frequently asked questions
What must a DPA contain?
8 mandatory elements (Article 28(3)): subject matter, duration, nature and purpose, categories of data, obligations, confidentiality, sub-processing, assistance with data subject rights + technical and organisational measures.
Who checks the processors?
The controller bears the duty to select and monitor them. In practice: an annual review of the processor list + a risk-based review of the technical and organisational measures.
Who is liable for a processor's breach?
Primarily the controller (externally). The processor is additionally liable for its own breaches of duty — internal recourse via the DPA.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, consult a qualified lawyer.