Data processor
A data processor is an organisation that processes personal data on behalf of a controller and only on that controller's documented instructions. Hosting providers, database services and email tools are typical processors: they hold the data but do not decide why it was collected or what it is used for.
What the role requires
GDPR article 28 says a processor may only be engaged under a written contract — a data processing agreement — and that contract must specify the subject matter, duration, nature and purpose of the processing, the types of data and categories of individuals involved, and the controller's rights.
The processor's own duties follow from that:
- act only on documented instructions, and flag an instruction it believes breaks the law,
- keep the data confidential and apply appropriate security measures,
- assist the data controller with responses to individuals' requests and with breach reporting,
- notify the controller of a personal data breach without undue delay,
- and delete or return the data when the engagement ends.
Sub-processors
A processor almost never works alone. When it uses another company underneath — a cloud host, a mail provider — that company is a sub-processor, and the arrangement requires the controller's authorisation, usually given as a general authorisation with notice of changes. The first processor remains responsible to the controller for what its sub-processors do.
NorthernGo is a worked example of the whole chain. When you build an app on it, you decide what your app collects, so you are the controller. NorthernGo processes that data on your instructions as your processor, with data residency in the EU/EEA, and its own sub-processors include Supabase and Firebase. The business is a Swedish sole trader based in Lycksele.
The misconception
The roles are the thing people most often get backwards, and the mistake is usually to assume the party holding the data is the one with the primary responsibility. It is not. Storing data does not make you a processor's controller — deciding the purpose does. An app builder's customer is normally the controller, and the builder is the processor.
The consequence is practical rather than theoretical: as controller you cannot outsource the duty to inform your users, to answer an erasure request, or to have a valid legal basis. A processor helps you do those things; it does not do them for you.
This entry explains the concepts and is not legal advice.
Frequently asked questions
Do I need a data processing agreement with every service I use?
With every service that processes personal data on your behalf, yes — hosting, database, email, analytics and support tools all typically qualify. Most providers publish a standard agreement you accept as part of their terms. This is an explanation of the requirement, not legal advice.
Build it yourself
NorthernGo turns a plain-text description into a working web app with a database, login and a live URL. Local AI generation runs on your own GPU, is unlimited, and is free on every plan.