Key points
- The GDPR distinguishes the controller, which determines the purposes and means, from the processor, which processes the data on its behalf.
- Article 28 of the regulation defines the scope of the processor’s role in order to protect the rights of data subjects.
- The processor must process the data only on the documented instructions of the controller set out in the contract.
- Compliance rests on the ability to prove the measures taken through documentation, records and procedures.
- A record of processing activities for each client demonstrates the processor’s rigour in the event of an inspection.
- Technical and organisational measures proportionate to the risks, such as encryption and access restriction, are mandatory.
The role of a processor under the GDPR is sometimes unclear, particularly as regards the legal obligations to be met and liability for non-compliance. Yet every operation involving personal data exposes organisations and their partners to inspections and even to significant penalties. A proactive, documented approach to personal data management is therefore essential, from the drafting of the data processing agreement through to day-to-day operations.
This guide sets out the main obligations of a GDPR processor, focusing on the relationship with the controller, the contractual framework to put in place and the operational management of security and traceability. Through these points, find out how to ensure GDPR compliance and limit the risks for your organisation.
What is a GDPR processor? Definition and scope of the role
The GDPR clearly distinguishes two main actors: the controller, which determines the purposes and means of the processing of personal data, and the processor, which processes that data on the controller’s behalf. The scope of the GDPR processor’s role is expressly set out in Article 28 of the regulation, in order to protect the rights of data subjects and to ensure a chain of compliance.
In practice, a processor may be an IT company hosting customer data, a provider offering technical support or a recruitment firm. As soon as it accesses or handles data on behalf of a third party, processor status applies and entails a series of specific obligations.
What are a processor’s obligations under the GDPR?
The GDPR imposes several direct requirements, structured around compliance, traceability and the demonstration of the measures taken to protect data. Meeting these obligations becomes a contractual as well as an operational imperative for any GDPR processor. To go further on this subject and gain an overall view, it may be useful to consult a data protection lawyer.
The aim is to provide the controller, and ultimately the data subjects, with rigorous and transparent management of the information entrusted.
Strict compliance with the controller’s instructions
Every processor must process personal data only on the documented instructions of the controller. Acting outside this framework is a clear breach of the GDPR, exposing the processor to penalties. The controller’s instructions must therefore be set out clearly in the data processing agreement, including where processing is passed on to another processor (sub-processing).
For example, if the controller requires limited retention of certain files, the processor then acts on that explicit instruction, including deleting them once the period has expired. This obligation also covers any requirement relating to data location or anonymisation.
Demonstrating GDPR compliance and transparency
GDPR compliance no longer rests solely on declarations, but on the ability to prove that all measures have been implemented: documentation, records, procedures... Traceability and transparency are essential. The record of the categories of processing activities carried out on behalf of each client, provided for by Article 30(2) of the GDPR, notably serves to demonstrate the processor’s rigour in the event of an inspection.
Likewise, prompt notification to the controller of any security incident contributes to mutual trust and meets a formal regulatory obligation. To better understand the full sequence of obligations imposed by the GDPR and the processor’s place within it, you can read this practical guide explaining the GDPR (in French).
Security measures and personal data protection obligations
Adopting appropriate technical and organisational measures is an essential foundation for any GDPR processor. These are not mere recommendations, but a genuine regulatory obligation “proportionate to the risks” presented by the processing.
From database encryption to access restriction and ongoing staff training, the standard required will depend on the volume, sensitivity and purpose of the processing carried out.
Practical examples of the security measures expected
Here are some commonly adopted measures:
- Advanced authentication protocols for access to internal tools
- Written description of backup procedures and data recovery
- Strict restriction of access rights according to the nature of the assignment
- Systematic encryption of mobile devices containing personal data
The degree of sophistication varies with the context, but the absence or weakness of these measures directly exposes the GDPR processor to liability before the competent authorities.
Handling personal data breaches and informing the controller
When a security breach occurs, the processor must notify the controller without undue delay after becoming aware of it. The controller can then meet its own notification obligations towards the CNIL (French data protection authority) or the data subjects. The data processing agreement must therefore set out clear reporting arrangements, with specific deadlines.
Poor preparation for these situations would jeopardise the whole business relationship, especially as the speed and completeness of the notification are closely scrutinised during a GDPR inspection.
The contract between controller and GDPR processor
The GDPR requires the parties to formalise their relationship in a written contract. This document provides a common foundation defining each party’s role, the processor’s responsibilities, its obligations and the limits of its involvement. In the event of a dispute, it will serve as evidence before the authority or the court.
Certain items are essential clauses that structure effective compliance from the start of the engagement.
Key clauses to include in the data processing agreement
Here are some essential provisions that are often included:
- A precise description of the subject matter, duration and purpose of the data processing
- A detailed list of the types of data processed and the categories of data subjects
- An explicit undertaking to act only on the documented instructions of the controller
- An obligation for the processor to assist the controller in handling requests to exercise rights (access, rectification, erasure)
- A principle of continuous traceability and auditability of the operations carried out
Other provisions may also govern the transfer of data to another processor, provide for regular audits or require the return/deletion of the data at the end of the contract. Each clause aims to clarify the GDPR processor’s responsibilities at each key stage.
Summary table: controller and processor responsibilities compared
| Controller | GDPR processor |
|---|---|
| Determines the purposes and means of processing | Processes the data according to the instructions received |
| Handles the exercise of individuals’ rights | Assists the controller with these requests |
| Bears overall responsibility for GDPR compliance | Must prove that the required measures are applied |
| Notifies personal data breaches to the CNIL | Reports any breach detected without undue delay |
This precise allocation helps prevent any risk of confusion over the division of tasks and fosters trust between the service provider and the client.
Frequently asked questions on GDPR processor obligations and liability
How can you identify a GDPR processor’s obligations in a contract?
The GDPR processor’s obligations generally appear in a dedicated section of the data processing agreement, covering personal data protection, traceability, security measures and the arrangements for assisting the controller. To avoid any misunderstanding, you are advised to check that the following clauses are present:
- Descriptions of the types of processing and the data concerned
- Instruction and communication process in the event of a security incident
- Audit arrangements and access to records of processing
What happens if a processor breaches its GDPR obligations?
If the GDPR processor fails to meet its obligations, several consequences may follow. It faces penalties imposed by the CNIL, such as fines of up to €10 million or 2% of annual worldwide turnover for breaches of its own obligations (Article 83(4) of the GDPR). Towards data subjects, it is liable for the damage only if it has breached its own obligations or acted outside the lawful instructions of the controller (Article 82(2)). The controller may also bring a contractual claim against it to obtain compensation for the loss suffered. Here is a summary table of the main risks:
| Type of breach | Possible consequences |
|---|---|
| Failure to notify an incident | Financial penalties, termination of the contract |
| Low level of security | Warning, external audits, loss of customers |
| Poor assistance to the controller | Complaints, damaged reputation |
What good practices help a processor achieve GDPR compliance?
Several simple steps contribute to GDPR compliance at the processor. These include:
- Regularly updating the records of processing carried out
- Organising personal data protection awareness sessions
- Periodically reviewing user access and authorisations
Keeping documentation up to date and strengthening the traceability of operations are among the priority levers for remaining compliant.
Can a processor engage another processor?
Yes, but the GDPR processor must obtain the prior written authorisation of the controller before subcontracting all or part of its assignment to a third party. The initial contract must set out the conditions for any such engagement, and all the data protection obligations will also apply to the new processor. Contractual monitoring of this chain ensures full traceability and limits areas of risk.
