Data Processor

The **Data Processor** is defined in GDPR Article 4(8) as any party that processes personal data on behalf of the controller. The processor's defining feature is constraint: it acts only on documented instructions from the controller under Article 29. Processing for the processor's own purposes converts the processor into a controller for that activity, with all the controller obligations attaching.\n\nArticle 28 sets out the mandatory content of the contract between controller and processor: subject matter, duration, nature and purpose of processing, types of personal data, categories of data subjects, controller obligations and rights, and binding processor commitments on confidentiality, security, sub-processor authorisation, assistance with data-subject rights, breach notification, and audit rights.\n\nProcessors have direct GDPR obligations of their own (security under Article 32, records of processing under Article 30(2), breach notification to the controller under Article 33(2), DPO appointment under Article 37 where applicable, international transfer safeguards under Chapter V). Processors can be fined directly by supervisory authorities for breaches of these direct obligations.

You will act as a processor when offering services to your customers: a SaaS that hosts customer data, a payroll bureau, a hosting provider, an email-sending tool. Your contracts with customers will include an Article 28 Data Processing Addendum (DPA), a sub-processor list, and Standard Contractual Clauses for any international transfers triggered by the service.