Data processor

A processor acts for a controller

A data processor is a separate organisation or person that handles personal data on a controller's behalf. It works within the controller's authority and documented instructions. A payroll bureau, cloud service or consultant may be a processor for a particular task, but the answer depends on what it actually does.

Employees carrying out their normal duties are part of the controller rather than processors. A supplier may choose practical, non-essential details within its instructions, such as the technical method used to store a file, without becoming a controller.

The contract must match the work

When a processor handles personal data for a controller, the agreement needs the required Article 28 terms. The ICO's controller-processor contract guidance covers the scope, duration, nature and purpose of the work, the information and people involved, instructions, confidentiality, security, assistance with rights and compliance, breach handling, return or deletion and evidence or audits.

A subprocessor needs the controller's prior specific or general written authorisation and must carry equivalent protections. Keep a register of processors, contracts, subprocessors, processing locations, access, deletion arrangements and the breach contact you would use out of hours.

Know when the role changes

If a processor decides its own purpose or the essential means of processing, it becomes a controller for that activity. A supplier can therefore hold different roles for different uses of the same service.

On discovering a personal data breach, a processor must tell the controller without undue delay. It should not wait to decide whether the ICO or affected people must be notified. That risk assessment and any external notification decision belong to the controller.