What is a Data Processor Responsible for in the Context of GDPR?

To understand what a data processor is responsible for under the General Data Protection Regulation (GDPR), it is first important to know what a data processor is. This article is part of our ‘Quick Guide Series’ which offers summaries and bullet point answers to common compliance questions.

Are You a Data Processor or Controller?

You need to be able to understand and describe the difference between a data controller and a data processor. Both functions have different requirements and obligations under the GDPR. Furthermore, the policies and controls you have in place need to comply with the relevant Articles and Recitals.

A data controller is the person, public authority, agency or body determining the purpose and means of the personal data processing. Occasionally, two or more controllers determine the processing purpose and means together. In this instance, they are referred to as ‘joint controllers’. However, this is only applicable where they are processing the same data for the same purpose(s).

“Controllers have a high degree of responsibility and are the main decision-makers”.

A data processor is the person, public authority, agency or body processing the personal data on behalf of the controller. Processors follow instructions provided by a controller and act on their behalf. Processors have less responsibility under the GDPR than a controller. However, they stil have some obligations under the Regulations.

“Processors do not collect personal data from individuals and only act on behalf of a controller”.

Dual Controlling and Processing

A person or entity cannot be both a data controller and processor for the same data processing activity. However, it is possible to be both controller and processor for different processing activities.

For example, you are a controller of the employee data you collect and process. However, you are also a processor for data your processes on behalf of a client who is a data controller.