Data processor
A data processor is an organization that processes personal data on behalf of a controller and only on its documented instructions, such as a hosting provider, an email service or an analytics vendor acting for the website.Article 4(8) of the GDPR defines the processor as a natural or legal person that processes personal data on behalf of the controller. The processor does not decide why or how the data is used; it follows the controller's instructions under a written contract (Article 28), keeps the data secure, helps the controller answer rights requests and breach duties, uses sub-processors only with authorization, and deletes or returns the data at the end. A processor that starts using the data for its own purposes becomes a controller for that use. Brazil's LGPD calls it the operador, POPIA the operator; California's CCPA has the comparable notions of service provider and contractor.
For a website, typical processors are the host, the consent management platform, a transactional email service, a support widget, and analytics tools configured to work only for the site. Advertising platforms, social networks and data brokers usually process the data for their own purposes as well and are therefore controllers or joint controllers, whatever their terms call them. Whether a vendor is a processor matters for cookies: in California, data sent to a true service provider is not a sale or sharing, while data sent to an advertising partner is.
The contract that governs the relationship is the data processing agreement. Cookiequiet acts as a processor for the consent records it stores for a website.