Skip to main content
Glossary termPublished inNormenkader IBP

Processor

Also known as verwerker, data processor

What does "processor" mean under the GDPR?

‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

Defined in / by

Last updated: 14 October 2026.

Acting on someone else's behalf

A processor handles personal data for a controller and on its instructions. For a school, the usual processors are the suppliers of the pupil administration system, the learning platform, the cloud storage and the email service. The test is not size or technical control. A large platform provider is still a processor for the data it holds for a school, as long as it does not decide on its own purposes for them.

Article 28 sets the terms. The controller may use only processors that provide sufficient guarantees of appropriate technical and organisational measures (Article 28(1)). The processor may not engage another processor without the controller's prior specific or general written authorisation (Article 28(2)). And the processing must be governed by a contract or other legal act that binds the processor to the controller, with the content Article 28(3) lists.

A processor that starts deciding its own purposes, for example by using pupil data to improve an unrelated product, is treated as a controller for that processing under Article 28(10). Kennisnet's begrippenlijst for the Normenkader IBP also lists the subverwerker, the sub-processor a processor engages in turn, which is the case Article 28(2) and 28(4) govern.

Questions and answers

Does a school need a contract with every processor under the GDPR?

Yes. Article 28(3) of the GDPR requires processing by a processor to be governed by a contract or other legal act that binds the processor to the controller and sets out the subject matter, duration, nature and purpose of the processing, the types of data and the controller's obligations and rights.

When does a processor become a controller under the GDPR?

When it determines the purposes and means of the processing itself. Article 28(10) of the GDPR provides that a processor that infringes the Regulation by doing so is considered a controller in respect of that processing.

Regulations

  • Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)

    The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.

    Next
    Every board knows its position against the Normenkader through a self-evaluation, and has a plan to meet all norms