Data processor

A processor acts on the controller’s instructions rather than for its own purposes: a payroll provider, a cloud host or a CRM vendor is typically a processor for the customer data it holds. It must be bound by a contract that meets Article 28, may use subprocessors only as that contract allows, and has direct obligations of its own, such as security (Article 32) and keeping a record of the processing it carries out (Article 30(2)).

Whether a company is a processor or a controller depends on what it actually does with the data, not on what the contract calls it.