Glossary
What is Data processor?
A data processor handles personal data on behalf of a controller, the business that decides why and how the data is used; an SMS provider texting your customers on your instructions is usually one.
Article 4(8) of the UK GDPR defines a processor as a person or body "which processes personal data on behalf of the controller". For business texts the controller is normally the business that chooses who to text and what to say, and the provider that stores the numbers and sends the messages is the processor.
Article 28 requires a written contract between the two. It binds the processor to act only on the controller's documented instructions, stops it bringing in another processor (a sub-processor) without the controller's prior specific or general written authorisation, and makes it delete or return the personal data, at the controller's choice, when the service ends.
Say a physiotherapy clinic in Exeter moves its reminders to a new SMS provider. The clinic stays responsible for its patients' numbers, so it should read the provider's processing terms and its list of sub-processors before it uploads a single contact.
Related