Data processor
Entity that processes personal data on behalf of a controller.
How the laws define this
Regulators consistently define a data processor as an entity or individual processing personal data on behalf of a data controller, acting under that controller's instructions and implementing required technical and organizational security safeguards. Frameworks diverge primarily in whether processors function purely under contractual delegation or bear direct, independent statutory obligations to authorities. Standard frameworks like the Personal Data Protection Act B.E. 2562 (2019) and the Organic Law on the Protection of Personal Data (LOPDP) frame the role around following instructions and assisting controllers. Conversely, the Security Assessment Measures for Outbound Data Transfers assigns direct, independent compliance obligations to processors operating in China, including data classification, self-assessments, and submitting official applications to authorities. Additionally, operational guidance like the Bogotá TransMilenio AI Facial Recognition Pilot and the Explanatory Note on Chatbots (ChatGPT Example) explicitly identify technical service providers, integrators, machine learning models, or cloud vendors as processors, whereas general statutes like the Personal Data Protection Bill, 2023 define the role without technology-specific examples.
Synthesised from the 13 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first. Showing 10 of the 13 instruments that define this term; all are listed under Definitions below.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| China | Measures for the Security Assessment of Outbound Data Transfers | In Force | Adds responsibilities for classifying data, performing self-assessments, submitting applications, implementing safeguards, and cooperating with inspections specifically for outbound data transfers from China. |
| Ethiopia | Personal Data Protection Proclamation No. 1321/2024 | In Force | Requires cooperation with the Ethiopian Communications Authority (ECA) alongside contractual and regulatory obligations. |
| Rwanda | Law No. 058/2021 Relating to the Protection of Personal Data and Privacy | In Force | Explicitly lists processing operations like collection, storage, retrieval, use, disclosure, or deletion. |
| Thailand | Personal Data Protection Act B.E. 2562 (2019) | In Force | Subjects processors to duties in subordinate rules under the PDPA and requires assisting controllers in fulfilling obligations. |
| Ecuador | Organic Law on the Protection of Personal Data (LOPDP) | In Force | Includes public authorities, agencies, or other bodies as potential processors and notes possible supervisory oversight. |
| Malaysia | Personal Data Protection Act 2010 (PDPA) | In Force (Amended) | Specifies that processors do not determine purposes or means of processing, distinguishing clearly from controllers. |
| Turkey | Explanatory Note on Chatbots (ChatGPT Example) | In Force | Provides examples like cloud or ML service providers and describes contractual safeguards aligned with KVKK. |
| Ghana | Ghana National Artificial Intelligence Strategy 2023-2033 | Adopted | Emphasizes implementing security, privacy-by-design, and other governance measures in the AI context. |
| Maldives | Personal Data Protection Bill | Proposed | Plain definition limited to acting under controller instructions with obligations for security and processing safeguards. |
| Nigeria | National Artificial Intelligence Strategy (NAIS) | Adopted | Adds duties for documentation and security specifically in AI deployments. |
What it triggers
- In China, under Measures for the Security Assessment of Outbound Data Transfers, requires classifying data, performing self-assessments, submitting applications, implementing safeguards, and cooperating with inspections.source
- In Ethiopia, processors must adhere to contractual and regulatory obligations, cooperate with the ECA, and implement appropriate technical and organizational measures.
- In Thailand, processors must implement appropriate security measures and assist the controller in fulfilling obligations under the PDPA.
- In Rwanda, processors must implement appropriate technical and organizational measures as required by the controller and law.
Definitions (13)
An entity that processes personal data on behalf of a data controller according to the controller's instructions, and which must adhere to contractual and regulatory obligations, cooperate with the ECA, and implement appropriate technical and organizational measures.
Third-party vendors, cloud providers or other service providers that process data on behalf of the controller under contract; processors must follow contractual requirements and technical measures (e.g., secure transfer, encryption) set out by the controller and the guide.
A natural or legal person who processes personal data on behalf of and under the instructions of a data controller, carrying out operations such as collection, storage, retrieval, use, disclosure, or deletion, and who must implement appropriate technical and organizational measures as required by the controller and law.
A person who processes personal data on behalf of a data controller, acting under the controller's instructions and subject to contractual and statutory duties set out in the PDPA and subordinate rules, including implementing appropriate security measures and assisting the controller in fulfilling obligations.
An entity that collects and processes data during operations inside China and that is responsible for classifying data, performing required self-assessments, submitting applications to authorities where necessary, implementing technical and contractual safeguards, and cooperating with regulator inspections under the Measures.
A role referenced by the Strategy and aligned with the Data Protection Act: an individual or organisation that processes personal data on behalf of a data controller, subject to contractual and regulatory obligations to implement security, privacy‑by‑design, and other governance measures.
A natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller, following the controller's instructions. Processors must apply appropriate security measures and may be subject to contractual obligations and supervisory oversight under the law.
A person or organization who processes personal data on behalf of the data user/controller but does not determine the purposes or means of processing. Processors are bound by contractual and statutory obligations to follow the controller's instructions and implement appropriate technical and organisational measures.
An entity that processes personal data on behalf of a data controller, acting under the controller's instructions and subject to obligations to implement appropriate security and processing safeguards.
An entity that processes personal data on behalf of a data controller, acting under the controller's instructions and subject to contractual and regulatory duties to implement appropriate technical and organisational measures for data protection, documentation, and security in AI deployments.
A person or entity that processes personal data on behalf of a data controller under instruction, required to implement technical and organizational security measures and assist controllers in meeting compliance obligations under the Bill.
An entity that processes personal data on behalf of a data controller (e.g., cloud or ML service provider) and must act only on controller instructions and under contractual safeguards aligned with KVKK requirements.
A natural or legal person, public or private, who by itself or in association with others performs processing of personal data on behalf of the Data Controller, for example an integrator or technology vendor contracted to run the facial recognition system.
Not to be confused with
Unlike the data controller, which determines the purposes and means of processing, the data processor acts only on the controller's instructions.
The personal information processor determines purposes and means of processing, while the data processor follows the controller's instructions without such determination.
Questions and answers
What extra duties do data processors have for outbound transfers from China?
Processors must classify data, perform self-assessments, submit applications where necessary, implement technical and contractual safeguards, and cooperate with regulator inspections. This applies under the Measures for the Security Assessment of Outbound Data Transfers.
Does a data processor decide how data is processed?
No, data processors process personal data only on behalf of and under the instructions of a data controller, without determining purposes or means.
What security obligations apply to data processors?
Processors must implement appropriate technical and organizational measures for security, as required by the controller and applicable laws across multiple jurisdictions.
Related Terms
Personal information processor
Entity determining purposes and means of personal data processing....
Processor (Encargado)
Entity that processes data on behalf of a controller....
Processor
Entity that processes data on behalf of the controller....
Data controller
Entity that determines purposes and means of processing....
Personal information processor (PIP)
Entity that processes personal data on behalf of a controller....