s.8 · s.2
Data Processor
A Data Processor is any person who processes personal data on behalf of a Data Fiduciary, and may do so only under a valid contract.
Section 8(2) allows a Data Fiduciary to engage a Data Processor only under a valid contract. The cloud host, the email provider, the analytics tool, the payroll vendor and the form builder embedded on a website are all Data Processors for the businesses that use them.
The Processor itself carries no direct obligations under the Act. Everything runs through the Fiduciary, which is why the contract matters: it is the only instrument that binds the Processor to the standard the Fiduciary is held to.
The Gevox scanner found that 16 of 20 websites of firms selling DPDP advice run their contact or intake forms through a third party and say nothing about it. A notice that cannot name the processor cannot describe the processing.
Questions people ask
- Do we need a written contract with every SaaS tool we use?
- Section 8(2) requires a valid contract for any processing a Processor does on your behalf. For most tools that is their standard terms plus a data processing agreement; the point is that one exists and covers the processing.
- Is Google Analytics a Data Processor?
- When it processes visitor data on your behalf, yes. The consent question under Section 6 is separate and comes first.
- Is a law firm a Data Processor for its clients?
- For personal data inside a client matter, usually yes: the client decides the purpose, the firm acts on its behalf.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.