Role
A Data Processor processes personal data on behalf of a Data Fiduciary, under that fiduciary's instructions and a valid contract.
"Data Processor" means any person who processes personal data on behalf of a Data Fiduciary.
The Data Processor acts for the fiduciary, not for itself. It handles data to deliver a service, but does not decide the purpose or means.
A fiduciary may engage a processor only under a valid contract (Section 8(2)), and stays responsible for the processor's compliance. The duty cannot be contracted away.
A payroll company that processes employee data strictly as its client instructs is a Data Processor. The employer is the Data Fiduciary.
See how this term differs from the ones people most often confuse it with.
Data Fiduciary vs Data Processor →Is a Data Processor liable under the Act?
The fiduciary carries primary responsibility. A processor acts under contract and instructions, and the fiduciary stays accountable.
Can one company be both?
Yes. It can be a fiduciary for its own purposes and a processor when handling another fiduciary's data.