Processor
Also known as: data processor · service provider · subprocessor
A processor is an organization that handles personal information on behalf of another, under its instructions and without determining the purposes.
The distinction from the controller is about decision-making power, not size: a cloud tool used by a three-person company is its processor, whatever its market capitalisation.
The relationship must be framed by a contract setting out the subject matter, duration, security measures, what happens to the data at the end, and the conditions for engaging a subprocessor.
Responsibility does not transfer with the data. Choosing a failing supplier remains the fault of whoever chose it, which is why vendor questionnaires exist.
What it means for a small business
This is the mechanism by which compliance travels down the chain: every serious customer pushes its obligations onto its suppliers by contract, and that is how a small business ends up having to prove its posture.
So what actually applies to you?
A definition tells you what a term means, not what your organization must do. The assessment answers the second question — free, no credit card.
Updated September 1, 2026 · Educational definition; not legal advice.