Definition
In privacy and data-protection law, a data processor is a separate person or organization that handles personal data for a controller. The controller decides the main purposes of processing and the important choices about what data is collected and why; the processor carries out the service on the controller’s behalf.
A processor may use its own technical expertise to decide how to perform the work—for example, how to store data securely or retrieve records—but it should not take the controller’s overarching decisions about the purpose of processing. The exact role depends on the specific processing activity, not simply on the type of organization involved.
A written controller–processor contract normally sets out the processing instructions, data categories, security requirements, use of sub-processors, support for individual rights, retention or deletion, and evidence of compliance. A service provider can be a processor for one activity and a controller for another.
What does that mean
Think of the controller as the person who decides what job needs to be done with the data. The processor is the trusted service provider that does that job for them, using the agreed instructions rather than deciding a new purpose of its own.
Why this matters
Identifying the right role makes accountability clearer. It helps organizations choose vendors carefully, document instructions, protect personal data, support people’s rights, and avoid treating a processor like an independent user of the data.
Use cases
Reviewing a digital analytics or SaaS vendor
When an organization wants to use a third-party platform with personal data, it needs to understand who decides the purpose of the processing and what the vendor is allowed to do.
Classifying the vendor as a processor where appropriate focuses the review on documented instructions, a written data-processing agreement, security measures, sub-processors, processing locations, retention, and support for data-subject requests.
The expected benefit is a clearer allocation of responsibility and a more informed procurement, privacy, and security decision.
Handling individual rights requests
A person may ask the controller to access, correct, export, restrict, or delete their personal data, while some of that data is held in a processor’s systems.
The processor supports the controller by locating the relevant records and carrying out agreed actions, such as returning, correcting, deleting, or restricting data, within the contract and the controller’s instructions.
This can make responses more consistent and timely while keeping the controller responsible for deciding how the request should be handled.
Limiting exposure in digital experience analytics
Teams often need behavioral and technical data to understand digital experiences, but collecting more personal data than necessary increases privacy and security risk.
A processor relationship creates a framework for specifying which data is processed, why it is needed, how it is protected, how long it is kept, and when information should be masked, deleted, or made anonymous.
The expected benefit is useful analysis with tighter control over the personal data that enters, moves through, or leaves the service.
How Contentsquare helps.
Contentsquare’s GDPR guidance explains the controller and processor responsibilities that apply when customers use the service, including documented instructions, individual-rights support, and controls to block personal data from collection.
Data Processing Agreement sets out the roles of the customer and Contentsquare, permitted purposes, processing instructions, data categories, sub-processors, and other contractual safeguards for the CS Service.
Data Connect lets teams select which datasets to sync to a warehouse, supporting cleaner pipelines, tighter governance, and more deliberate control over downstream access.
Session Replay provides privacy-compliant replay of customer experiences and automatically masks personal information such as card and bank details, helping teams investigate issues without exposing unnecessary data.
FAQs on data processors.
A data processor is a separate person or organization that processes personal data on behalf of a data controller. It acts under the controller’s authority and instructions for the agreed service.
The processor may make operational or technical choices about how to perform the work, but it should not decide the overarching purpose of the processing.