A data processor is an individual or organization that processes personal data on behalf of a data controller. They do not own the data or decide how it is used but act strictly according to the controller’s instructions. Data processors are commonly third-party service providers, such as cloud storage companies or payroll firms, who handle data for specific tasks. Under regulations like the GDPR, data processors have legal obligations to protect data, maintain security, and report breaches. They must also ensure that any sub-processors they use meet the same data protection standards. The controller remains ultimately responsible for compliance.