Processor
Definition
A natural or legal person, public authority or other body that processes personal data on behalf of the controller and according to its instructions.
A processor handles personal data for someone else's purposes. Cloud hosting, payroll services, customer support outsourcing and many AI API providers act as processors when they use client data only to deliver the contracted service. The GDPR (Art. 28) requires a written contract that limits processing to documented instructions and imposes confidentiality, security, assistance with data subject requests and DPIAs, deletion or return of data at the end, and audit rights. Sub-processors need the controller's authorisation.
The LGPD uses the term operador (Art. 5, VII and Art. 39). The operador must follow the controller's lawful instructions and is jointly liable for damage when it breaches the law or acts outside those instructions.
The label is not permanent. A vendor that reuses client prompts to improve its own general model is deciding a new purpose and becomes a controller for that activity. That is why AI vendor due diligence checks the provider terms on training, retention and sub-processors before signing.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 1: Data protection foundations.
Also covered in: Responsible AI Practitioner (RAIP)
Primary sources
- GDPR Art. 4(8) and Art. 28
- LGPD Art. 5, VII and Art. 39