A Data Processor is any organization or person (other than the controller) that processes personal data on behalf of the controller and following their instructions. This includes cloud providers, payroll companies, and other service providers handling personal data.
Data Processors have specific legal obligations under GDPR, including implementing appropriate security measures, assisting the controller with data subject rights, and only processing data as instructed. A Data Processing Agreement must be in place between the controller and processor.