A data processor is an organisation that handles personal data on behalf of someone else, the controller, which decides why the data is processed and the essential elements of how. Article 4(8) of the General Data Protection Regulation (GDPR) defines it as "a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller". The concept exists because few companies run their own infrastructure. Cloud hosts, analytics vendors and artificial intelligence (AI) providers handle data that remains their customers' legal responsibility, provided the vendor stays inside its instructions.

In advertising, the label is frequently disputed. Whether a platform is a processor or a controller determines who needs a lawful basis, who answers a data subject's request, and who pays when something goes wrong.

Two conditions and a contract

The European Data Protection Board (EDPB) sets out the test in Guidelines 07/2020, adopted in final form on July 7, 2021. "Two basic conditions for qualifying as processor exist: that it is a separate entity in relation to the controller and that it processes personal data on the controller's behalf," according to the guidelines. An internal department therefore does not qualify.

The line between the two roles runs through the means of processing. "Essential means", such as which data is collected, how long it is kept and who receives it, stay with the controller; "non-essential means", such as hardware choices, "can be left to the processor". Contract labels do not settle the matter. "If one party in fact decides why and how personal data are processed that party will be a controller even if a contract says that it is a processor," the guidelines state.

Article 28 then governs the relationship. The controller "shall use only processors providing sufficient guarantees", and processing must rest on "a contract or other legal act", usually called a data processing agreement or data processing addendum (DPA). Article 28(3) lists eight required terms. The processor acts "only on documented instructions", binds staff to confidentiality, applies Article 32 security, respects the rules on sub-processors, helps answer data subject requests, assists with breach notification and impact assessments, deletes or returns the data when the service ends, and submits to audits.

The processor also carries obligations of its own. Article 29 forbids it from processing data "except on instructions from the controller". Article 30(2) requires records of processing for each client, and Article 33(2) requires breach notice to the controller "without undue delay". Fines fall in the lower tier under Article 83(4): up to 10 million euros or 2% of worldwide annual turnover, whichever is higher.

Sub-processors and the chain

A processor that hires another processor creates a sub-processor. An analytics vendor may rely on a cloud host, a content delivery network and support contractors. Article 28(2) bars the processor from engaging another processor "without prior specific or general written authorisation of the controller". Under general authorisation, the processor must announce changes and give the controller "the opportunity to object". Article 28(4) passes the obligations down the chain and leaves the initial processor "fully liable to the controller" for a sub-processor's failures.

In practice, general authorisation dominates. Vendors publish sub-processor lists and set notice windows, which vary widely. Anthropic's DPA, effective February 24, 2025, gives customers 15 days to object to a new sub-processor or be deemed to consent. OpenAI's API DPA, effective January 1, 2026, allows 30 days. Microsoft's terms, after a May 22, 2026 update, give six months' notice for most sub-processors but 30 days for those supporting AI functionality.

The EDPB tightened expectations in Opinion 22/2024, adopted on October 7, 2024. Controllers should have the identity of "all processors, sub-processors etc. readily available at all times", according to the opinion, and must verify the chain "regardless of the risk", though not by collecting every sub-processing contract.

Where processors sit in advertising

Ad platforms divide their own products. Google's service list, last updated on October 23, 2025, places Google Ads, AdSense and Google Ad Manager under its Controller-Controller Data Protection Terms. Google Analytics, Tag Manager, Campaign Manager 360, Display & Video 360, Search Ads 360, Ads Data Hub, Customer Match and Enhanced Conversions run under its Ads Data Processing Terms, as processor services. One advertiser can thus be Google's processor client in measurement and a fellow controller in media buying.

AI companies selling ads have copied that structure. OpenAI's Ad Tools DPA, effective August 19, 2026, makes each party "an independent Data Controller" for its conversion and audience tools. Only "Restricted Processing" - matching advertisers' customer lists to OpenAI users, and data flagged as opted out in Europe, the UK and listed US states - makes OpenAI a processor. OpenAI began accepting customer lists of up to 512MB for ChatGPT ads in May 2026. For its application programming interface (API) business, by contrast, OpenAI "acts as a Data Processor on the Customer's behalf", according to its DPA.

Choosing a processor is itself a compliance act. The Polish data protection authority fined McDonald's Polska about 3.89 million euros on July 21, 2025, partly for selecting a staff-scheduling processor on the strength of past public relations work. The processor, 24/7 Communication, was fined about 42,000 euros for using sub-processors without notice.

From directive to regulation

The term predates the GDPR. The 1995 Data Protection Directive (95/46/EC), adopted on October 24, 1995, defined the processor and required a written contract binding it to act only on the controller's instructions. Processors had almost no direct legal exposure. The Article 29 Working Party's Opinion 1/2010, adopted on February 16, 2010, interpreted the two roles for over a decade.

The GDPR, adopted on April 27, 2016 and applicable from May 25, 2018, gave processors their own duties, direct fines and liability to individuals under Article 82(2) when they breach processor-specific obligations or act "outside or contrary to lawful instructions". On June 4, 2021, the European Commission adopted Implementing Decision (EU) 2021/915, the first EU-wide standard contractual clauses for Article 28 contracts.

On December 5, 2023, in a case about a Lithuanian contact-tracing app (C-683/21), the Court of Justice of the EU held that a controller can be fined for processing carried out on its behalf by a processor, and that the absence of a formal contract does not rule out a controller-processor relationship.

Why the role carries weight

The role lets an advertiser hand a customer file to a vendor without the vendor acquiring rights to it, but only while the vendor does not reuse the data. Under Article 28(10), a processor that determines purposes and means "shall be considered to be a controller in respect of that processing".

France's data protection authority, the CNIL, applied that logic to Optimove, the marketing platform used by Deezer. CNIL found the company had copied non-anonymised user data to a test environment in April 2019 and kept it after the contract ended in December 2020. It fined Optimove 1 million euros on December 11, 2025, citing Articles 28, 29 and 30. Deezer had notified a breach affecting 46.9 million users on November 10, 2022.

Disputes also arise when a client disappears. Norway's authority found that Timegrip, a time-tracking vendor, became a controller after its client went bankrupt because it alone decided on access and retention,, fining it 250,000 Norwegian kroner on January 16, 2026.

Limits and disputes

The binary model fits poorly with platforms that offer one product in several roles. The label matters because a processor needs no lawful basis of its own, which gives vendors a reason to claim it. Regulators look past the claim when the facts point the other way, as the Optimove, Timegrip and Xandr decisions show.

Bargaining power is the other dispute. Article 28 assumes the controller instructs and audits, yet with large cloud and AI providers customers accept standard terms and audit through third-party reports. Hesse's commissioner found that Microsoft's September 2022 DPA failed seven points, including Article 28 requirements, before approving revised terms for Microsoft 365 on November 15, 2025. That approval applies only in Hesse. The EDPB's expectation that controllers see every sub-processor down the chain also sits uneasily with objection windows as short as 15 days.

Not the same as

Data controller. The controller decides the purposes and essential means of processing, carries the main compliance duties and needs a lawful basis. A processor needs none of its own for client work.

Joint controller. Under Article 26, two parties that jointly determine purposes and means share responsibility. Norway's authority rejected Xandr's claim to be a processor for Grindr data and treated it as a joint controller in its NOK 92 million decision of October 2, 2026, stating that "accountability cannot be outsourced". The joint controller explainer covers the test.

Service provider. The California Consumer Privacy Act (CCPA) uses "service provider" and "contractor" for a similar role, defined by contract restrictions on use. Virginia's 2021 law and most later US state privacy laws adopted the GDPR's controller-processor vocabulary instead.

Data processor in computing. In engineering, the phrase means software or hardware that transforms data. It carries no legal meaning.

Recent developments

Sweden's IMY fined Miljödata 1.8 million Swedish kronor under Article 32 on September 22, 2026, after a ransomware attack affected about 2.2 million people. The company acted mainly as a processor, sometimes a sub-processor, for more than 300 customers; IMY did not separate the roles because Article 32 binds both.

Contract terms are moving too. Microsoft's May 2026 AI track and OpenAI's August 2026 Ad Tools DPA, which makes the same company a processor for API customers and an independent controller for most advertiser data, show the roles being redrawn product by product as AI companies sell advertising.

Timeline

  • October 24, 1995: Data Protection Directive 95/46/EC defines the processor and requires a binding contract
  • February 16, 2010: Article 29 Working Party adopts Opinion 1/2010 on controllers and processors
  • April 27, 2016: GDPR adopted, with Article 28 and direct processor obligations
  • May 25, 2018: GDPR becomes applicable
  • September 2, 2020: EDPB adopts draft Guidelines 07/2020 for consultation
  • June 4, 2021: Commission adopts Implementing Decision (EU) 2021/915 on Article 28 standard contractual clauses
  • July 7, 2021: EDPB adopts final Guidelines 07/2020
  • November 10, 2022: Deezer notifies CNIL of a breach traced to its former processor Optimove
  • December 5, 2023: CJEU rules in C-683/21 that a controller can be fined for processing by its processor
  • October 7, 2024: EDPB adopts Opinion 22/2024 on processors and sub-processors
  • February 24, 2025: Anthropic DPA takes effect with a 15-day sub-processor objection window
  • July 21, 2025: Polish authority fines McDonald's Polska and its processor over processor oversight
  • November 15, 2025: Hessian commissioner approves Microsoft's revised processor terms for Microsoft 365
  • December 11, 2025: CNIL fines Optimove 1 million euros under Articles 28, 29 and 30
  • January 1, 2026: OpenAI API DPA takes effect with a 30-day objection window
  • January 16, 2026: Norway's authority fines Timegrip after finding it acted as a controller
  • May 22, 2026: Microsoft introduces 30-day notice for AI sub-processors
  • August 19, 2026: OpenAI Ad Tools DPA takes effect
  • September 22, 2026: Sweden's IMY fines processor Miljödata 1.8 million kronor
  • October 2, 2026: Norway's authority rejects Xandr's processor claim in its Grindr decision

Summary

Who. Vendors that handle personal data for clients: cloud hosts, analytics and tag management tools, email and customer data platforms, AI model providers and the sub-processors they rely on. Controllers choose and supervise them; the EDPB, the CJEU and national authorities police the line between the roles.

What. A legal role under Article 4(8) of the GDPR, governed by an Article 28 contract that limits the processor to documented instructions and imposes duties on security, assistance, deletion, audits and sub-processing, with direct fines up to 10 million euros or 2% of turnover.

When. Defined in the 1995 Data Protection Directive, given direct obligations when the GDPR applied on May 25, 2018, and refined by EDPB guidance in 2021 and 2024 and by enforcement against processors from 2025 to 2026.

Where. Across the European Economic Area and the UK, with equivalents such as the "operator" in Brazil's LGPD and the "service provider" in California, wherever personal data passes through outsourced systems.

Why. Outsourcing would be impossible if every vendor became responsible for its clients' data decisions. The processor role keeps responsibility with the party that decides, as long as the vendor stays within instructions. Once it uses data for its own ends, it becomes a controller.