Data Processor

What is a data processor?

A data processor is a company that handles personal data on behalf of another business. Under the GDPR, the EU privacy law, a processor "processes personal data on behalf of the controller" (Article 4(8)).

The data controller is the business that decides why and how the data is used. When you put customer records into a CRM, you are the controller and the CRM vendor is your processor.

Most SaaS vendors act as processors for the data you put into their products. Your helpdesk, email platform, file storage and payroll tools all handle data for you. The contract that sets the rules is the data processing agreement (DPA), required by GDPR Article 28.

US privacy laws use a similar idea under a different name. California's law calls it a service provider.

What a processor can and cannot do

A processor works inside the limits you set. Under Article 28, it:

• Can process your data to deliver the service, following your documented instructions.
• Can use subprocessors, but only with your permission, and must tell you about changes so you can object.
• Must keep the data secure, keep staff bound to confidentiality, and help you answer people's requests.
• Must tell you about a personal data breach without undue delay (Article 33(2)).
• Must delete or return your data when the service ends, as you choose, unless a law requires it to keep a copy.
• Cannot use your data for its own purposes. The EDPB, the body of EU privacy regulators, says processors must act only on the controller's instructions.

Processors also have duties of their own. The UK regulator, the ICO, says processors can face fines and other penalties and can be sued by individuals in some cases.

What it looks like in a vendor's terms

A typical clause reads like this:

For Customer Personal Data, you are the controller and we are the processor. We will process it only on your instructions to provide the services. For account, billing and usage information about you, we act as an independent controller under our privacy policy.

• "You are the controller and we are the processor" sets the roles for the data you put in.
• "Only on your instructions" is the core processor duty.
• "Independent controller" means the vendor decides for itself how to use certain data.
• "Account, billing and usage information" is the data that often falls outside the DPA's protections.

Stripe's DPA, for example, describes Stripe "acting as a Data Processor on behalf of User" for some processing and as a controller for other purposes, such as fraud monitoring and compliance.

When a vendor becomes a controller

A vendor is a processor only while it follows your instructions. Article 28(10) says that if a processor decides the purposes and means of processing, it "shall be considered to be a controller" for that processing. The EDPB says a processor that goes beyond your instructions breaks the GDPR and becomes a controller for that part.

Two common situations raise this question:

• AI training. If a vendor uses your data to train models that serve all its customers, it may be acting for its own purpose. See AI training on customer data.
• Advertising and data products. Using your data to target ads or build a commercial dataset is a purpose the vendor chose, not you. See usage data.

Some vendors state the split openly. Atlassian's DPA says it also acts as a controller under its privacy policy, and that the DPA "does not limit or prohibit" it from doing so.

A real change we caught

Roles can shift when terms change. Venpo flagged that Bolt now claims ownership of your customer data. Its Merchant Terms of Use, revised in June 2026, say Bolt keeps sole ownership of the data and accounts of end users who transact through its platform, even though merchants keep ownership of their own data. When a vendor claims to own data it handles for you, it is fair to ask whether it is still acting only as your processor for that data.

Why it matters to you

Your promises depend on it. If you told your customers that their data is only used to provide your service, a vendor acting as a controller can break that promise for you.

The DPA only covers processor data. Anything the vendor handles as a controller falls under its privacy policy instead. That policy can change, and it may allow AI training, marketing or sharing with partners.

Your vendor list must be accurate. Records you keep, such as records of processing activities, and answers to customers often ask which vendors process data for you. Getting the role wrong makes those answers wrong.

What to check

• Find the roles section in the DPA and note which data the vendor handles as processor and which as controller.
• Read the vendor's privacy policy for the data it controls, especially usage and account data.
• Look for AI training, advertising or data products among the vendor's own purposes.
• Check whether the vendor can use aggregated or de-identified versions of your data freely.
• Ask the vendor to confirm in writing that your content is processed only on your instructions.

How Venpo helps

Venpo monitors your vendors' DPAs and privacy policies and emails you a plain-English alert when the terms about how they use your data change. The Fine Print Scan answers, for each vendor, whether it trains AI on your data and whether it sells data or uses it for ads.