Processor
Entity that processes data on behalf of the controller.
How the laws define this
Every cited framework agrees that a processor is a natural or legal person, authority, or entity that processes personal data on behalf of another party according to its instructions and contractual security obligations. Jurisdictions primarily diverge regarding the formal title of the directing party, data scope, and practical application context. Most instruments, including the Personal Data Protection Law (PDPL) (Royal Decree M/19) and the Federal Act on Data Protection (FADP) — total revision, state that the processor acts on behalf of a controller. Conversely, the Digital Personal Data Protection Act, 2023 specifies that processing occurs on behalf of a data fiduciary, while the Medellín Police Facial Recognition System references the Responsible for Treatment. Scope also varies, as the Digital Personal Data Protection Act, 2023 restricts its definition to digital personal data rather than personal data generally. Finally, the Medellín Police Facial Recognition System explicitly identifies technology providers operating software as concrete examples, unlike statutes such as Lög um persónuvernd og vinnslu persónuupplýsinga nr. 77/2018 that remain strictly abstract.
Synthesised from the 11 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first. Showing 10 of the 11 instruments that define this term; all are listed under Definitions below.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| India | Digital Personal Data Protection Act, 2023 | Awaiting Entry | Specifies processing of digital personal data only, identifies data fiduciary as controller equivalent, and references prescribed contractual and security obligations. |
| Saudi Arabia | Personal Data Protection Law (PDPL) (Royal Decree M/19) | In Force (Amended) | Includes authorities and agencies as possible processors, and explicitly lists obligations like security measures, sub-processing restrictions, breach notifications, and audits. |
| Senegal | Law No. 2008-12 on the Protection of Personal Data | In Force | Requires processing only on documented instructions and mandates ensuring confidentiality plus appropriate technical and organizational security measures. |
| Qatar | Law No. 13 of 2016 Concerning Personal Data Privacy Protection | In Force | Adds specific obligation to notify controllers of security incidents alongside implementing technical and organisational measures. |
| Switzerland | Federal Act on Data Protection (FADP) — total revision | In Force | Adds public bodies as possible processors and emphasizes both contractual and statutory duties without specifying further obligations. |
| Iceland | Act on Data Protection and the Processing of Personal Data No. 77/2018 | In Force | Explicitly includes public authorities and agencies, and limits processing to specific contractual terms. |
| France | Law No. 2018-493 of 20 June 2018 - Law on the Protection of Personal Data | In Force (Amended) | Requires acting only on documented instructions and aligns obligations explicitly with GDPR provisions. |
| Indonesia | Law No.27/2022 on Personal Data Protection | In Force | Adds obligations regarding subcontracting and accountability beyond general security and instruction-based processing. |
| Chile | Law No. 21.719 — Regulates the protection and processing of personal data and creates the Personal Data Protection Agency | Awaiting Entry | Includes public authorities and agencies, and specifies cooperation duties alongside security measures and following instructions. |
| Colombia | Medellín Police Facial Recognition System | In Force | Provides concrete examples like technology providers operating facial recognition software, and classifies as either public or private. |
What it triggers
- In Saudi Arabia under the PDPL, processors must comply with contractual obligations including security measures, sub-processing restrictions, and cooperation in breach notifications and audits.
- Under Qatar's Law No. 13 of 2016, processors must implement technical and organisational measures and notify controllers of security incidents.
- Under Senegal's Law No. 2008-12, processors must ensure confidentiality and appropriate technical and organizational security measures.
Definitions (11)
A person or organisation that processes digital personal data on behalf of a data fiduciary, acting under its instructions and subject to contractual and security obligations prescribed by the Act and subordinate rules.
A natural or legal person, authority, agency, or other body that processes personal data on behalf of the controller and under its instructions. Processors are subject to contractual and compliance obligations defined by the PDPL and implementing regulations, including security measures, sub-processing restrictions, and cooperation in breach notifications and audits.
A person or entity that processes personal data on behalf of the controller, acting only on documented instructions, and required to ensure confidentiality and appropriate technical and organizational security measures as set out by the controller and statute.
A person or entity that processes personal data on behalf of a controller pursuant to instructions and contracts, with obligations to implement technical and organisational measures and to notify controllers of security incidents.
A natural or legal person or body that processes personal data on behalf of a controller under their instruction and subject to contractual and statutory duties.
A natural or legal person who processes personal data on behalf of a controller under instruction and contract, subject to specific contractual safeguards and obligations concerning sub‑processing and security measures.
A natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller under specific contractual terms.
A natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller under instruction or contract, required to follow the controller's instructions and to implement appropriate technical and organisational security measures and cooperation duties set by the law.
A natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller and must act only on documented instructions, under contractual obligations set by the law and GDPR-aligned provisions.
A person or entity that processes personal data on behalf of a controller under instruction, subject to contractual and legal obligations in the Act regarding security, subcontracting, and accountability.
A natural or legal person, public or private, that performs processing activities on behalf of the Responsible for Treatment and under their instructions. Examples include technology providers (e.g., Herta Security) that operate the facial recognition software and must comply with contractual and legal obligations regarding security and lawful processing.
Not to be confused with
Data processor refers generally to any entity processing personal data on behalf of a controller, while processor here always carries specific statutory obligations tied to instructions and contracts.
Data controller/processor applies specifically to entities in AI systems, whereas processor applies more broadly to personal data processing contexts outside AI.
Questions and answers
What obligations do processors have under the Saudi PDPL?
Processors must follow contractual and compliance obligations including security measures, restrictions on sub-processing, and cooperation in breach notifications and audits. These apply when processing on behalf of the controller.
Does processor include public authorities?
Yes, several definitions explicitly include public authorities, agencies or bodies as processors, such as in Saudi Arabia, Iceland, France, Chile and the Medellín policy.
What security duties apply to processors?
Processors must implement technical and organisational security measures in Qatar, ensure confidentiality and security in Senegal, and follow similar obligations in most listed instruments.
Related Terms
Data processor
Entity that processes personal data on behalf of a controller....
Data controller/processor
Entities determining or processing personal data for AI systems....
Personal information processor
Entity determining purposes and means of personal data processing....
Processor (Encargado)
Entity that processes data on behalf of a controller....
Processor (Prosesor Data Pribadi)
Entity processing personal data on controller's behalf....