Data Processor
Definition
An entity that processes personal data on behalf of a data controller, following the controller's instructions. Processors do not decide how or why data is used. California uses the equivalent term "service provider."
Legal Definition
Under the VCDPA (Va. Code 59.1-575): "a natural or legal entity that processes personal data on behalf of a controller." Under the CCPA, the equivalent is a "service provider" (Cal. Civ. Code 1798.140(ag)) or "contractor" (Cal. Civ. Code 1798.140(j)).
State Laws Using This Term
Practical Example
A company hires a cloud hosting provider to store customer data. The hosting provider is a data processor because it processes data according to the company's instructions without making independent decisions about the data.
Related Terms
Frequently Asked Questions
What contracts are required between controllers and processors?
Most state privacy laws require a written data processing agreement (DPA) between controllers and processors. The DPA must specify the nature and purpose of processing, the type of data, duration, and the processor's obligations regarding confidentiality and security.