A GDPR lawyer from us assesses the processor role, contractual requirements and supplier due diligence
A data processor is an external party engaged to carry out specific tasks. Typical examples include services for marketing, data analytics and administrative systems. Where one organisation sells a service to another and processes personal data on the buyer’s instructions, the seller acts as the data processor for the buyer.
Processing personal data on the buyer’s instructions means the seller must follow the guidelines set by the controller. The data processor has a defined mandate to perform certain processing on behalf of the controller, who determines the purposes and means of the processing.
Where a processor relationship exists, GDPR requires a data processing agreement to be in place. This agreement sets the scope and purpose of the processing and the categories of personal data involved, and clarifies the processor’s rights and obligations.
In some cases, multiple parties may share responsibility as joint controllers. They must coordinate to ensure all legal requirements are met.
We review how the collaboration is set up and identify who actually determines the purposes and means of the processing, so the correct role is set from the outset. This provides a stable foundation for contractual requirements and allocation of responsibilities.
We make clear which instructions are needed for the processing and where the practical boundaries lie. This makes it easier to assess what is permitted in the ongoing delivery.
We draft or review a data processing agreement that reflects your processes and supplier chains without becoming unnecessarily theoretical. The focus is on feasibility and traceability.
We align on how technical and organisational measures, and cooperation on incidents and data subject rights requests, should work in day-to-day operations. The result is clear contact routes and expectations that reduce friction when something happens.
We set up a simple routine for changes in the service—for example new sub-processors or new types of data—and how this should be documented. This ensures the agreement remains relevant as the business develops.
As a processor, you need to demonstrate that you follow instructions and maintain adequate security. Ensure agreements are clear and that your storage and incident routines work in practice. Click through to align delivery with your customers’ expectations.
Morling Consulting drafts, reviews and negotiates data processing agreements and provides ongoing advisory support on compliance. Our support reduces the risk of acting contrary to the contract or GDPR by giving you clarity on interpretation and application. Our services include:
We also assess the roles of parties in collaborations involving personal data processing. Correctly identifying whether you are a controller, a data processor or operating under joint controllership is essential to meeting GDPR requirements across Europe.
Primary responsibilities
A data processor must implement appropriate technical and organisational measures proportionate to the risks posed by the processing. This may include encryption, access controls and regular security reviews. These measures must align with the controller’s instructions.
Beyond security, the data processor must support the controller in handling data subject requests and in notifying and managing any data breaches or other personal data incidents.
In summary, the GDPR data processor plays a key role in enabling compliance. By following GDPR requirements and cooperating closely with the controller, processors help ensure compliance is maintained. The data processor’s main responsibilities include:
If you have questions about data processing agreements or need support managing personal data, contact us. We will discuss your needs and provide guidance aligned to your operations.
Whether you are drafting new agreements, reviewing existing ones or seeking advice on a specific matter, we act as a sounding board and provide practical, business-focused guidance.
A controller determines why and how personal data are processed, while a data processor only processes the data according to the controller’s instructions.
Example: A company engages an external agency to send customer emails. The agency receives customer lists and uses them in line with the company’s instructions. The agency is the data processor; the company that set the purpose is the controller.
A data processing agreement is required when an external party processes personal data on behalf of a controller. This is a legal requirement under GDPR and applies, for example, when:
The agreement ensures the processing is secure and lawful.
Without a well-structured contract, there is a greater risk of non-compliant processing and personal data incidents. Ambiguity over responsibilities can undermine control, and the Data Protection Agency may intervene with sanctions and significant fines. Trust can also be damaged among customers, partners and the public.
It depends on who decides the purposes and means of the processing:
Morling Consulting can clarify roles for your operations and each collaboration involving personal data. For those asking “what is a data processor”, we map your activities to the correct role.
We provide advice and practical support to help you comply with GDPR. This includes:
No, but strict conditions apply when the processor is outside the EU/EEA. International transfers must meet GDPR requirements, for example by using standard contractual clauses (SCC). Morling Consulting helps you manage international transfers.
Under GDPR, a compliant agreement should, for example, cover:
Morling Consulting drafts and reviews agreements so that nothing material is overlooked. For organisations asking “what is a data processor” or seeking a concise data processor definition, we ensure the contract terms reflect your operating reality.
Yes — but not for the same processing. An organisation may be a controller in one context and a processor in another. Each processing activity must be analysed and roles clearly defined. Morling Consulting helps draw these boundaries so you act correctly in every part of your business.
Examples include:
Our advisory is built around your structure, needs and challenges across Europe.
Do you need to assess the processor’s role or a supplier structure? Contact us to discuss
"*" indicates required fields
