processor
CIPP/E glossary · Last reviewed: · By Victor Humenhuk (CIPP/E certified)
processor - The entity that processes personal data on behalf of the controller; keeps its own Article 30 record with controller-focused content.
In the CIPP/E body of knowledge, processor comes up under Ch 11.4 - Records & cooperation; Ch 17.2.2 - Controller vs processor; Ch 18.2.1-18.2.2 - Who is who.
processor in context
- It raises data protection standards and, given mutual influence, ==mirrors many GDPR concepts== (the definition of [[processor]], a legal basis for processing, expanded special categories, breach notification, transparency and accountability). (Convention 108+)
- Two flashpoints: whether [[IP address|IP addresses]] and [[cookie|cookies]] are [[personal data]] (now clarified - the definition expressly includes ==online identifiers==), and where the boundary between [[controller]] and [[processor]] sits (left unchanged despite the debate). (Introduction to Data Protection Concepts)
- A [[processor]] processes personal data ==on behalf of== a controller on its ==documented instructions==, and is a ==subordinate figure== with a narrower set of direct obligations (security, record-keeping, breach notification to the controller, transfer rules). (Controller vs Processor - Roles and Liability)
Where processor is covered in the CIPP/E study notes
- Controller vs Processor - Roles and Liability
- Documentation and records of processing (Article 30)
- Cloud: controllership issues
- Roles of the parties: controller and processor
- Module 3 · Controller vs processor
Related terms
- controller
- DPIA
- Article 30
- Article 31
- Records of processing
- Controller
- Joint controllers
- Essential means
- Article 29 Working Party (WP29)
- EDPB
Test yourself on processor
Recognising a definition is not the same as applying it in an exam scenario. Work through the free CIPP/E practice questions, or read the full CIPP/E study guide - every study note is free.