{"id":19708,"date":"2026-03-15T02:11:00","date_gmt":"2026-03-15T01:11:00","guid":{"rendered":"https:\/\/www.rosello-mallol.com\/?p=19708"},"modified":"2026-03-06T14:18:14","modified_gmt":"2026-03-06T13:18:14","slug":"data-processor","status":"publish","type":"post","link":"https:\/\/www.rosello-mallol.com\/en\/data-processor\/","title":{"rendered":"Data Processor: Some Say They Are Processors, But They\u2019re Not"},"content":{"rendered":"\n

One of the most common questions in data protection is the difference between a data processor and a data controller<\/strong><\/a> under the General Data Protection Regulation (GDPR).<\/p>\n\n\n\n

In professional practice, it is very common to encounter situations where a company claims that a third party is its data processor<\/strong>, when in fact what exists is a transfer or disclosure of personal data<\/strong>.<\/p>\n\n\n\n

This distinction is important. If the relationship is truly a data processing engagement<\/strong>, a contract must be formalized as required under Article 28 of the GDPR<\/strong><\/a>. But if what exists is a data transfer<\/strong>, the third party becomes a data controller<\/strong>, with its own legal basis and obligations.<\/p>\n\n\n\n

The issue arises when organizations try to \u201cfit\u201d a relationship under the label of access to data on behalf of a third party<\/strong> simply because there is access to personal data. However, not all access by a third party makes them a data processor.<\/p>\n\n\n\n

Below are some common examples where many organizations assume there is a data processing engagement when, in reality, the third party is an independent controller.<\/p>\n\n\n\n

Key difference between data controller and data processor<\/h2>\n\n\n\n

The core GDPR principle is relatively simple.<\/p>\n\n\n\n

A data processor<\/strong> processes personal data only under the instructions of the data controller<\/strong> and does not independently determine the purposes or essential means of the processing.<\/p>\n\n\n\n

In contrast, a data controller<\/strong> is the entity that determines the purposes and means of processing personal data<\/strong>.<\/p>\n\n\n\n

When a third party has real autonomy in how it handles data<\/strong>, has its own legal obligations, or acts for independent purposes, the typical scenario is that there are two controllers, meaning there is a transfer or disclosure of personal data<\/strong>.<\/p>\n\n\n\n

Banks: are they processors?<\/h2>\n\n\n\n

A common case occurs when a company shares client or employee data with a bank to manage payments, financing, or direct debits.<\/p>\n\n\n\n

Sometimes this relationship is framed as if the bank were a processor. However, banks operate under their own sectoral regulations and are subject to multiple legal obligations.<\/p>\n\n\n\n

The bank decides what controls to apply, how to manage data within its systems, and how to comply with legal obligations (for example, anti-money laundering rules). Therefore, it does not act solely on the company\u2019s instructions but within its own operational framework.<\/p>\n\n\n\n

In this context, the bank acts as an independent data controller<\/strong>, and the access to the data constitutes a data transfer<\/strong>.<\/p>\n\n\n\n

Temporary Employment Agencies (ETTs)<\/h2>\n\n\n\n

Another common example involves Temporary Employment Agencies (ETTs).<\/p>\n\n\n\n

When a company shares candidate or employee data with an ETT to fill positions, the relationship is sometimes documented as a processing engagement.<\/p>\n\n\n\n

However, the ETT conducts its own business activity: managing recruitment processes, evaluating candidates, and processing data under its own legal and labor obligations.<\/p>\n\n\n\n

Consequently, the ETT does not act solely on the client\u2019s instructions<\/strong> but decides how to conduct the recruitment process, so it typically acts as a data controller<\/strong>.<\/p>\n\n\n\n

Transport or courier companies<\/h2>\n\n\n\n

Another frequent scenario involves transport or courier companies that receive customer data to perform deliveries.<\/p>\n\n\n\n

To provide the service, the carrier usually has access to data such as the recipient\u2019s name, address, or phone number. At first glance, it may seem that the carrier is merely accessing data on behalf of the selling company.<\/p>\n\n\n\n

However, the transport company organizes its own logistics, manages delivery issues, decides how to perform the delivery, and may even contact the recipient directly.<\/p>\n\n\n\n

Thus, in many cases it acts as an independent data controller<\/strong>, and the transfer of this data constitutes a necessary data disclosure<\/strong> for service provision.<\/p>\n\n\n\n

Vehicle leasing or rental companies<\/h2>\n\n\n\n

It is also common that in vehicle leasing or rental contracts, a company shares employee or driver data with the financial institution or leasing company.<\/p>\n\n\n\n

Sometimes this relationship is formalized as a processing engagement, but the leasing company conducts its own financial or leasing operations.<\/p>\n\n\n\n

This means it manages contracts, evaluates risks, applies compliance controls, and processes the data in its own systems.<\/p>\n\n\n\n

Therefore, the leasing company generally acts as an independent data controller<\/strong>, not as a processor.<\/p>\n\n\n\n

Occupational health and safety services<\/h2>\n\n\n\n

Another typical example occurs when a company provides employee data to an external service in compliance with the Occupational Risk Prevention Law.<\/p>\n\n\n\n

Although the service accesses personal and even health-related data, its activities are regulated by specific laws, and it has its own professional obligations.<\/p>\n\n\n\n

These services determine what information they need, how to conduct assessments or medical examinations, and how to manage data in compliance with applicable regulations.<\/p>\n\n\n\n

Therefore, they normally act as data controllers<\/strong>, not processors.<\/p>\n\n\n\n

Conclusion: not all access to data makes a processor<\/h2>\n\n\n\n

In data protection, it is common for relationships to be automatically documented through a data processing contract<\/strong>, even when this is not legally accurate.<\/p>\n\n\n\n

However, incorrectly labeling a data transfer<\/strong> as access on behalf of a third party<\/strong> can create compliance issues: wrong legal bases, inaccurate privacy policies, or improperly drafted contracts.<\/p>\n\n\n\n

Before signing a data processing agreement, ask yourself a simple question:<\/p>\n\n\n\n

Does the third party process the data solely according to instructions, or does it also make its own decisions about the processing?<\/strong><\/p>\n\n\n\n

In many cases, the answer shows that some claim to be data processors\u2026 but in reality, they are not<\/strong>.<\/p>\n\n\n\n

Author: Victor Rosello<\/strong>, Lawyer.<\/p>\n\n\n\n

If you need help writing Data Protection regulations, contact us!<\/p>\n\n\n\n

\n
\n

<\/p>

    <\/ul><\/div>\n
    \n
    \n<\/fieldset>\n