What is the definition of Processor according to GDPR?

According to Article 4(8) of the GDPR, a 'processor' is defined as a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller. The defining characteristic of a processor is that it acts upon the documented instructions of the controller. The processor does not determine the purposes (the 'why') and the essential means (the 'how') of the processing activity; this responsibility lies solely with the controller. Common examples of processors include cloud hosting providers, payroll services, and marketing automation platforms.

A. A processor is explicitly authorized by the controller to process personal data, typically governed by a legally binding contract or data processing agreement (DPA).
B. This describes a Supervisory Authority, an independent public body responsible for monitoring the application of the GDPR within a Member State.
D. This is the official GDPR definition of a 'controller', the entity that determines the purposes and means of processing personal data.

1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Article 4(8) provides the definition of 'processor': "'processor' means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller".

Article 4(7) provides the contrasting definition of 'controller'.

Article 51 outlines the role and creation of the 'Supervisory authority'.

2. European Data Protection Board (EDPB). (2021). Guidelines 07/2020 on the concepts of controller and processor in the GDPR. Version 2.1, Adopted on 7 July 2021.

Section 2.2, Paragraph 41: "The two basic conditions for qualifying as a processor are on the one hand that it is a separate entity in relation to the controller and on the other hand that it processes personal data on the controller’s behalf."

3. Voigt, P., & Von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer International Publishing.

Chapter 3, Section 3.2.2, "Processor", p. 28: "The processor is the party processing personal data on behalf of the controller... The decisive criterion is that the processor does not process the data for its own purposes." DOI: 10.1007/978-3-319-57959-7