{"head":{"title":"What Is a Data Processor Under the GDPR? | OceanLab","description":"Under the GDPR, a data processor handles personal data on a controller's behalf and only on its instructions. Duties, sub-processors and common mistakes.","canonical":"https://oceanlab.in/glossary/data-processor"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"data processor","path":"/glossary/data-processor"}],"slug":"data-processor","term":"Data processor (GDPR)","aka":["processor","sub-processor"],"category":"Compliance","short":"Under the GDPR, an organisation that processes personal data on behalf of a controller and only on its documented instructions.","body":[["GDPR Article 4(8) defines a processor as a person or body that processes personal data on behalf of the ",{"href":"/glossary/data-controller","text":"controller"},". Article 28 requires a binding contract, the ",{"href":"/glossary/dpa","text":"DPA"},", under which the processor acts only on documented instructions, keeps the data secure, helps the controller meet its duties, and deletes or returns the data at the end."],["A processor may only use another processor, a sub-processor, with the controller's authorisation, and must pass the same obligations down."]],"why":["Most B2B software companies are processors for their customers' data. That means signing DPAs, keeping a list of sub-processors, and building the product so customers can export, correct and delete data on request."],"example":["A helpdesk SaaS stores tickets for its business customers. It is their processor. Its cloud host and its email delivery service are sub-processors, listed on its website, and customers are told before a new one is added."],"inBuild":["When OceanLab or any partner builds a product, the hosting, email, analytics and AI services chosen during the build become the product's sub-processor list, so it pays to choose them with that list in mind."],"mistakes":[["Using customer data for your own purposes, which can make you a controller for that use."],["Adding a new sub-processor, such as an LLM API, without telling customers."],["No way to delete one customer's data cleanly when their contract ends."]],"related":[{"href":"/glossary/data-controller","label":"Data controller (GDPR)","detail":"Under the GDPR, the organisation that decides why and how personal data is processed, alone or jointly with others."},{"href":"/glossary/dpa","label":"DPA (data processing agreement)","detail":"The contract the GDPR requires between a data controller and a processor that handles personal data for it."},{"href":"/glossary/data-residency","label":"Data residency","detail":"Where data is physically stored and processed, and the laws or contracts that say where it may and may not go."},{"href":"/glossary/encryption-at-rest","label":"Encryption at rest","detail":"Encrypting stored data, such as databases, files and backups, so it cannot be read without the key."}],"tools":[],"links":[{"href":"/compliance/gdpr","label":"GDPR guide","detail":"Who the GDPR applies to and what it asks of software."},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."},{"href":"/software","label":"Software by industry","detail":"Systems we build per industry, with guides and tools."}],"sources":[{"title":"Regulation (EU) 2016/679, the GDPR (Official Journal)","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}