---
title: "Processor"
description: "Processor under the GDPR, Article 4(8): a person or body that processes personal data on behalf of the controller, such as a hosting or software supplier."
canonical: "https://gencompl.ai/glossary/processor-gdpr"
language: "en-US"
type: "Glossary term"
published: "2026-10-14T18:22:55.898Z"
modified: "2026-10-14T19:20:56.074Z"
---

# Processor

‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

Also known as: verwerker, data processor

**What does "processor" mean under the GDPR?**

Defined in: [Normenkader IBP](https://gencompl.ai/regulations/normenkader-ibp)

[Home](https://gencompl.ai/) › [Glossary](https://gencompl.ai/glossary) › Processor

> ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

## Defined in / by

- [GDPR (32016R0679)](https://eur-lex.europa.eu/eli/reg/2016/679/oj), Article 4, point (8)

Last updated: 14 October 2026.

## Acting on someone else's behalf

A processor handles personal data for a controller and on its instructions. For a school, the usual processors are the suppliers of the pupil administration system, the learning platform, the cloud storage and the email service. The test is not size or technical control. A large platform provider is still a processor for the data it holds for a school, as long as it does not decide on its own purposes for them.

Article 28 sets the terms. The controller may use only processors that provide sufficient guarantees of appropriate technical and organisational measures (Article 28(1)). The processor may not engage another processor without the controller's prior specific or general written authorisation (Article 28(2)). And the processing must be governed by a contract or other legal act that binds the processor to the controller, with the content Article 28(3) lists.

A processor that starts deciding its own purposes, for example by using pupil data to improve an unrelated product, is treated as a controller for that processing under Article 28(10). Kennisnet's begrippenlijst for the Normenkader IBP also lists the subverwerker, the sub-processor a processor engages in turn, which is the case Article 28(2) and 28(4) govern.

> **What we could not establish**
>
> This entry fixes the term as the GDPR words it. It does not decide whether a given processing at your school or organisation meets the Regulation; that is a question for your data protection officer or counsel.

## Questions and answers

### Does a school need a contract with every processor under the GDPR?

Yes. Article 28(3) of the GDPR requires processing by a processor to be governed by a contract or other legal act that binds the processor to the controller and sets out the subject matter, duration, nature and purpose of the processing, the types of data and the controller's obligations and rights.

### When does a processor become a controller under the GDPR?

When it determines the purposes and means of the processing itself. Article 28(10) of the GDPR provides that a processor that infringes the Regulation by doing so is considered a controller in respect of that processing.

## Sources

- [Regulation (EU) 2016/679 (General Data Protection Regulation)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679) (EUR-Lex · 4 May 2016)
- [Normenkader IBP: begrippenlijst](https://normenkaderibp.kennisnet.nl/begrippenlijst/) (Kennisnet)

## Related content

### Regulation

- [Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)](https://gencompl.ai/regulations/normenkader-ibp): The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.