Data processor: who is one, and what it obliges you to do

A data processor handles personal data on behalf of somebody else and only on their instructions. A controller decides why and how the data is processed. The distinction sounds academic until something goes wrong, because it determines who answers to the regulator, who tells the affected people, and who carries the liability — and getting it wrong in a contract does not change the answer.

Telling a data processor from a controller

• Who decided the purpose? If you decided why the data is being used, you are a controller regardless of what the contract calls you.
• Who chose what data to collect and how long to keep it — those are controller decisions.
• Can you use the data for your own purposes? A processor cannot, and doing so makes you a controller for that use.
• Do you exercise professional judgement about the data? Accountants and lawyers are usually controllers for that reason, even though they act for a client.
• Two organisations deciding jointly are joint controllers, which is a third category with its own requirements.

Why the label is decided by conduct

Regulators look at what actually happens rather than at the heading on the agreement. A supplier described as a processor who in practice decides retention periods, enriches the data for their own analytics, or determines what gets collected is acting as a controller, and the contractual description does not protect either side. The practical consequence is that the clause should follow a decision about how the relationship actually works, rather than being lifted from a template and left to describe something that is not happening.

Check sub-processors specifically. A processor using their own suppliers must have your authorisation and must pass the same obligations down — and the list of who those suppliers are is a question worth asking before signing rather than after an incident.

What a processor contract must contain

1. The subject matter, duration, nature and purpose of the processing, and the categories of data and people involved.
2. That the processor acts only on documented instructions.
3. A confidentiality commitment covering everybody with access.
4. Security measures appropriate to the risk, described rather than asserted.
5. Rules on sub-processors: authorisation, and the same terms flowing down.
6. Assistance with data subject rights, breach notification and impact assessments.
7. What happens at the end — deletion or return, with the choice being the controller's.
8. Audit rights, which exist to be exercisable rather than merely written.

Ettex Records is a reasonable home for the register of who processes what on your behalf, with the agreement, the sub-processor list and the end-of-contract position attached. That register is also what answers the question a breach raises first, which is whose data was involved and who has to be told.