Data processor

A company or person that processes personal data on behalf of a controller and on its instructions — for example a cloud provider, a payroll bureau or an HR system. The processor may not use the data for its own purposes and must meet the GDPR's requirements for security and confidentiality. The relationship must be governed by a written data processing agreement. If the processor uses subcontractors (sub-processors), the controller's authorisation is required.