Outsourced processing is the handling of personal data by a contractor or service provider on behalf of another organization. The contractor may store, sort, analyze, or transmit records, but the original organization still decides why the data is used and remains responsible for protecting it. This arrangement is common in payroll, customer support, cloud hosting, and business outsourcing.
In cyber security, outsourced processing matters because it expands the attack surface beyond the main company. A breach, malware infection, or weak access control at a vendor can expose data even when the controller’s own systems are not directly compromised. Defenders manage this risk with due diligence, data minimization, contractual security requirements, logging, incident notification rules, and regular oversight. In attacks, criminals often target the weaker third party to reach sensitive information; in defense, the goal is to limit what the contractor can see and to detect problems quickly.