What the role means
A processor does what it is told with data it does not own the purpose of. Article 28 of the GDPR requires a written contract covering the subject matter, duration, nature and purpose, the types of data and categories of subject, and a specific list of obligations: confidentiality, security, assistance with data subject rights, deletion or return at the end, and permission before engaging another processor.
A processor that starts deciding purposes for itself becomes a controller for that processing, whatever the contract says. This is why "we may use your data to improve our services" clauses deserve attention.
Subprocessors
A vendor is a subprocessor only when it processes the controller’s personal data on the processor’s behalf. Hosting and email providers often do; a payment, identity, fraud or platform provider may instead be an independent controller for some operations. Record roles per processing activity, list actual subprocessors with locations and safeguards, and notify changes as the governing contract requires.
Common questions
Do I need a DPA with my consent platform?
If it processes personal data on your behalf, yes: Article 28 requires a contract with defined terms. The DPA page describes the arrangement here, including the controller and processor roles and the subprocessor list.
Sources and verification
Verified on . Product-behaviour statements were checked against the current implementation and tests. The links below are the verification basis recorded for this article. They support the stated facts, not a legal conclusion for every site or configuration; recheck changing vendor behaviour before relying on it in production.
- Regulation (EU) 2016/679 (GDPR)
Legislation
Checked
See what your own site is loading
A browser scan reports the requests and storage it observed during the sampled journey. Use configured workspace scans to compare the states and pages that matter to your implementation.