# Data processor

> A data processor is an organisation that processes personal data on behalf of a controller and only on that controller's documented instructions. Hosting…

Source: https://northerngo.com/glossary/data-processor/
Language: en
Updated: 2026-08-28

---
**A data processor is an organisation that processes personal data on behalf of a controller and only on that controller's documented instructions. Hosting providers, database services and email tools are typical processors: they hold the data but do not decide why it was collected or what it is used for.**

### What the role requires

GDPR article 28 says a processor may only be engaged under a written contract — a data processing agreement — and that contract must specify the subject matter, duration, nature and purpose of the processing, the types of data and categories of individuals involved, and the controller's rights.

The processor's own duties follow from that:

- act only on documented instructions, and flag an instruction it believes breaks the law,
- keep the data confidential and apply appropriate security measures,
- assist the [data controller](/glossary/data-controller/) with responses to individuals' requests and with breach reporting,
- notify the controller of a personal data breach without undue delay,
- and delete or return the data when the engagement ends.

### Sub-processors

A processor almost never works alone. When it uses another company underneath — a cloud host, a mail provider — that company is a sub-processor, and the arrangement requires the controller's authorisation, usually given as a general authorisation with notice of changes. The first processor remains responsible to the controller for what its sub-processors do.

NorthernGo is a worked example of the whole chain. When you build an app on it, you decide what your app collects, so you are the controller. NorthernGo processes that data on your instructions as your processor, with data residency in the EU/EEA, and its own sub-processors include Supabase and Firebase. The business is a Swedish sole trader based in Lycksele.

### The misconception

The roles are the thing people most often get backwards, and the mistake is usually to assume the party holding the data is the one with the primary responsibility. It is not. **Storing data does not make you a processor's controller — deciding the purpose does.** An app builder's customer is normally the controller, and the builder is the processor.

The consequence is practical rather than theoretical: as controller you cannot outsource the duty to inform your users, to answer an erasure request, or to have a valid legal basis. A processor helps you do those things; it does not do them for you.

This entry explains the concepts and is not legal advice.

---

NorthernGo is an AI-powered platform for building production-ready web apps with zero coding. Local AI generation via WebGPU is unlimited and free, and you own all generated source code. https://northerngo.com/