What is a data processor?

A data processor is someone who processes personal data on behalf of another organisation and on its instructions.

The organisation that decides why and how personal data is processed is the controller. A supplier that processes the data for it is a processor. The terms come from the General Data Protection Regulation.

An AI supplier that receives your questions and documents usually becomes a processor. That requires a data processing agreement that describes how the data is handled, protected and deleted.

If the AI service runs entirely in your own environment, the supplier processes no data for you. No such agreement is then needed for the processing itself.

How it works

A controller may only use processors that offer sufficient guarantees of protection. The processor must help the controller meet its obligations, for example during incidents and when data subjects exercise their rights. Sub-processors may only be engaged with the controller's authorisation.

Why it matters

Responsibility for the processing stays with you, even when a supplier carries it out. You therefore need to be able to show the supplier was chosen with care and that the agreement is followed. The agreement also decides what happens to the data when the relationship ends.

What to keep in mind

If the supplier uses the data for its own purposes, such as improving its services, it is no longer acting purely as a processor. For that processing it becomes a controller itself.

A supplier's standard agreement can be reasonable, but read it. Making sure it is sufficient is your responsibility.

A processor may not change the processing on its own. If a supplier wants to move the data somewhere new or switch sub-processor, you should be told in advance and be able to object.

What it means for you

Read what the data processing agreement says about sub-processors, storage location and deletion when the contract ends.

Common questions

Is our AI supplier a data processor?

Usually, if it processes your questions and documents on your behalf. What matters is who decides the purposes and means. Whoever decides is the controller.

What should a data processing agreement cover?

Among other things, what is processed and why, how the data is protected, which sub-processors are used and what happens when the contract ends. The requirements are set out in Article 28 of GDPR.

What is a sub-processor?

Another supplier that the processor engages to process your data, for example for hosting. The processor needs your written authorisation to use sub-processors.

Is an agreement needed if everything runs on our premises?

If the supplier processes no personal data for you, no processing agreement is needed for that processing. That can change if the supplier gets access, for example during support.

Sources: GDPR, Articles 4 and 28, on EUR-Lex Data controllers and data processors at IMY

Related terms

All terms Updated 2026