A data processor is a person or organization that handles personal data on behalf of a controller and only under that controller’s instructions. The processor may store, transmit, sort, enrich, or delete data, but it does not decide the purpose of the processing. In privacy and security programs, this distinction matters because the controller remains responsible for choosing trustworthy providers and setting clear limits on what they can do.
In cyber security, processors are common in cloud hosting, payroll, customer support, and outsourced collections. They can become a major attack surface if access is too broad, logging is weak, or monitoring is absent. Good defense requires contracts, technical controls, and ongoing oversight: least-privilege access, encryption, audit trails, incident reporting, and review of how the processor actually works. If a processor is compromised or behaves outside instructions, the controller may face data exposure, compliance failures, and shared liability.