Data processor (GDPR)
Also called processor, sub-processor.
Under the GDPR, an organisation that processes personal data on behalf of a controller and only on its documented instructions.
Last updated
What it is.
GDPR Article 4(8) defines a processor as a person or body that processes personal data on behalf of the controller. Article 28 requires a binding contract, the DPA, under which the processor acts only on documented instructions, keeps the data secure, helps the controller meet its duties, and deletes or returns the data at the end.
A processor may only use another processor, a sub-processor, with the controller's authorisation, and must pass the same obligations down.
Why it matters
Most B2B software companies are processors for their customers' data. That means signing DPAs, keeping a list of sub-processors, and building the product so customers can export, correct and delete data on request.
In a product build
When OceanLab or any partner builds a product, the hosting, email, analytics and AI services chosen during the build become the product's sub-processor list, so it pays to choose them with that list in mind.
Common mistakes.
- 01
Using customer data for your own purposes, which can make you a controller for that use.
- 02
Adding a new sub-processor, such as an LLM API, without telling customers.
- 03
No way to delete one customer's data cleanly when their contract ends.
Read the official text.
Primary sources this definition is based on.
- Regulation (EU) 2016/679, the GDPR (Official Journal)checked 2026-10-25
Related terms.
- Data controller (GDPR)Under the GDPR, the organisation that decides why and how personal data is processed, alone or jointly with others.
- DPA (data processing agreement)The contract the GDPR requires between a data controller and a processor that handles personal data for it.
- Data residencyWhere data is physically stored and processed, and the laws or contracts that say where it may and may not go.
- Encryption at restEncrypting stored data, such as databases, files and backups, so it cannot be read without the key.
Guides and pages
Browse the full glossary or read answers to common questions.
