Data processor obligations under GDPR

Data processor obligations under UK GDPR

Article

8 mins read

Updated on 30 April 2025

If you process personal data on behalf of clients, your business has legal responsibilities under UK GDPR as a data processor
.

Whether you're managing payroll data, providing cloud hosting services, or delivering analytics based on customer lists, your obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 are specific, direct, and legally binding. Many service providers underestimate these responsibilities – often at their peril.

Our experienced data protection solicitors help businesses navigate the often complex landscape of processor obligations, from reviewing contracts and mapping data flows to advising on international transfers, training and regulator engagement. If you're processing data for others, understanding your role and responsibilities isn't just a regulatory necessity – it's a critical step in protecting your business from enforcement, reputational damage, and commercial loss.

Your role under data protection law depends on how you handle personal data in practice:

• You are a data controller if you decide how and why personal data is used.
• You act as a processor if you only handle data based on a controller’s instructions. Being a processor means you have no autonomy about how personal data is used – this is all up to the controller, who calls the shots.

If your service delivery gives you access to the personal data of a controller, then you’re likely a processor:

• You have access to your client’s systems, which contain personal data.
• You handle payroll data provided by your client, using it solely for payroll purposes.
• You store customer data as part of a service, e.g. in hosting or support, but don’t use that data for your purposes.
• You carry out customer-dictated tasks, such as email marketing or analytics, by using the data and instructions provided by your client.

You can be a controller and a processor for different activities, too. You might be a processor when you deliver email campaigns for a client using a client’s contact list, but at the same time, a controller when you send marketing messages to your clients for your own business. Your role depends on the context and level of control you have over personal data.

In some situations, you and another party may jointly determine the purposes and means of processing. In this case, you are joint controllers, and additional considerations will apply.

It is essential that you accurately determine each party’s role in a data processing scenario, as this will directly dictate the legal obligations that arise under data protection law. If you’re unsure of your role, it’s essential to take legal advice to make sure you don’t fall foul of your obligations.

As a data processor, you have specific responsibilities under the UK GDPR:

• Follow written instructions: You must only process personal data in accordance with your controller client’s written instructions. If you use it differently or for your purposes, you might be deemed a controller, which brings about additional legal obligations.
  If your client gives you an instruction you believe is unlawful, then you should raise this with them immediately.
• Protect personal data with security measures: You are responsible for protecting personal data by implementing appropriate technical and organisational measures to safeguard the data you hold against cyber attacks or data breaches. The specific measures you choose must be justified based on your risks and circumstances. Common examples include:
  - Passwords and access controls
  - Encryption
  - Multi-factor authentication (MFA)
  - Staff training and awareness
  - Regular risk assessments and reviews
  Failure to implement sufficient security can have serious consequences. For example, the Information Commissioner's Office (ICO) fined a data processor over £3 million for failing to use multi-factor authentication. This highlights that even processors must prioritise robust data security.
• Train your staff: Ensure that your staff understand…