Skip to content

Ledger entryNo. 085300

Data Processor

Also called: DPDP data processor · GDPR processor · Sub-processor

Definition
An organisation that processes personal data only on another's instructions, the role a messaging provider usually holds under the DPDP Act and GDPR.

Policy, consent & trust

Mode · versus

Work it out

Who decides, and who acts on instructions?

8 / 8

Data fiduciary / controller

Decides why and how data is processed

Data processor

Processes it on the fiduciary's instructions

  1. Data fiduciary / controllerThe brand messaging its customers
    Data processorBSP, CRM, chatbot vendor, cloud host, Meta
  2. Data fiduciary / controllerYes — whom to message and why
    Data processorNo — follows the contract
  3. Data fiduciary / controllerCollects consent, gives the notice
    Data processorHelps capture it if instructed
  4. Data fiduciary / controllerDirectly responsible, including for its processors
    Data processorThrough the contract
  5. Data fiduciary / controllerFull controller obligations
    Data processorDirect duties: instructions, security, records, breach alerts
  6. Data fiduciary / controllerNotifies regulators and affected people
    Data processorTells the fiduciary without undue delay
  7. Data fiduciary / controllerDecides deletion or return
    Data processorDeletes or returns as instructed

Verdict

The role follows who decides the purpose, not who holds the servers: a vendor using your data for its own ends becomes a fiduciary for that use.

The same WhatsApp data from both sides of the contract. Compare what the data fiduciary (controller) and the data processor each do and answer for under the DPDP Act and the GDPR.

Verdict: The role follows who decides the purpose, not who holds the servers: a vendor using your data for its own ends becomes a fiduciary for that use.

What is a data processor?

A data processor is any person who processes personal data on behalf of another. India's Digital Personal Data Protection Act defines it as processing on behalf of a data fiduciary (section 2(k)); the GDPR, on behalf of a controller (article 4(8)). The processor does not choose why data is used — it carries out the instructions of the business that does. In WhatsApp messaging that describes most of the stack: the Business Solution Provider (BSP) that runs the inbox and campaigns, the CRM, the chatbot vendor, the cloud host and Meta, which processes Cloud API message content as a data processor and keeps message data for at most 30 days.

The two laws treat processors very differently. The DPDP Act places its duties on the data fiduciary, which may use a processor only under a valid contract, must protect data processed on its behalf and must make processors erase data when consent is withdrawn or the purpose ends (section 8). The processor's obligations arrive through that contract, and the Act's penalties are aimed at fiduciaries. The GDPR binds processors directly as well: they must act only on documented instructions, keep records of processing, secure the data, use sub-processors only with authorisation, tell the controller of a breach without undue delay and follow the transfer rules — and they can be fined and sued.

The role follows what a company does, not what its contract calls it. A BSP is a processor while it sends and stores messages for you; it becomes a data fiduciary or controller for any processing whose purpose it decides itself, such as training its own models on your customers' chats or marketing to them. A sub-processor is a processor's processor — the BSP's cloud host or AI vendor — and should be listed in your Data Processing Agreement.

Key takeaways

  • A data processor handles personal data on someone else's behalf and on their instructions; it does not decide why the data is processed.
  • A WhatsApp BSP, CRM, chatbot vendor or cloud host is usually a processor for the brand, which is the data fiduciary or controller.
  • India's DPDP Act puts duties on the fiduciary, which answers for its processors; their obligations arrive through the contract.
  • The GDPR also binds processors directly — security, records, breach notice to the controller — and can fine them up to €10M or 2% of turnover.
  • A vendor that uses customer data for its own purposes becomes a fiduciary or controller for that processing.

Example: One lab, four processors

A Lucknow diagnostics lab sends test-ready alerts and health-package offers on WhatsApp. The lab is the data fiduciary. Its processors are the BSP that sends the templates and hosts the shared inbox, Meta's Cloud API underneath, a CRM that stores patient contacts and a chatbot vendor that answers "where is my report?". Each processes data only for the lab's purposes, under contracts listing their sub-processors. When the chatbot vendor asks to reuse anonymised chats to improve its product for other clients, the lab's lawyer points out that, for that reuse, the vendor would be acting for its own purposes — so the lab either agrees it explicitly, with notice to patients, or refuses. It refuses.

The figures

A data processor: key facts and limits

DPDP definition
Processes on behalf of a data fiduciary (s. 2(k))
GDPR definition
Processes on behalf of a controller (art. 4(8))
Contract required
DPDP s. 8(2); GDPR art. 28
DPDP liability
Sits with the fiduciary, incl. for its processors (s. 8(1))
GDPR fines on processors
Up to €10M or 2% of worldwide turnover (art. 83(4))
Meta's role (Cloud API)
Processor; message data kept at most 30 days

How does a data processor work?

  1. The fiduciary decides the purpose

    The brand chooses whom to message, why, and what to keep. That decision makes it the data fiduciary or controller.

  2. A contract carries the instructions

    The DPA sets what the processor may do, the safeguards, sub-processors, breach notice, rights support and deletion. Under the DPDP Act, no processor may be used without one.

  3. The processor does the work, and only that

    It sends templates, stores conversations and runs the chatbot as instructed, secures the data and keeps records of what it processes.

  4. Sub-processors join only with permission

    Hosting, AI and support vendors behind the processor are added with the fiduciary's authorisation and on the same terms.

  5. Breaches and requests flow back to the fiduciary

    The processor reports breaches to the business quickly and helps it answer access, correction and erasure requests; the business notifies regulators and customers.

  6. At the end, data is deleted or returned

    When the contract ends or consent is withdrawn, the processor deletes or hands back the data as instructed and confirms it.

Why does a data processor matter?

Getting the role right decides who must do what. Treat your BSP as a processor and you know the consent, notices and breach notices are yours, and that its duties must be written into the contract. Miss a vendor's own uses of your data and you have a second fiduciary handling customer chats under a notice that never mentioned it. For a vendor, being a processor under the GDPR still means direct obligations and fines, so EU-facing BSPs need their own records, security programme and breach process.

Costly mistakes

Common mistakes with a data processor

  • Assuming the processor carries your duties

    Under the DPDP Act the fiduciary answers for processing done on its behalf. Consent, notices and breach notifications stay with you; the contract only makes the vendor help.

  • Missing the vendor's own purposes

    Analytics, model training or cross-client benchmarking on your data turns a processor into a fiduciary for that use. Ask every vendor what else it does with your data, and write the answer into the DPA.

  • Forgetting sub-processors

    Your BSP's cloud host and AI vendor see your customers' chats too. Require a current list with locations and advance notice of changes.

  • Treating GDPR processors like DPDP ones

    A vendor serving EU customers has direct GDPR obligations and liability even as a processor. EU-facing BSPs need their own records, security and breach process, not just the client's contract.

Best practices for a data processor

  • Classify every vendor in your WhatsApp stack as processor, sub-processor or fiduciary, and review the list when you add a tool.
  • Ask processors for security evidence such as ISO 27001 certification or a SOC 2 report.
  • Make deletion on withdrawal a tested, end-to-end flow across every processor.

Data Processor FAQs

Is a WhatsApp BSP a data processor or a data fiduciary?
Usually a data processor. It sends and stores messages on the business's instructions; it is a data fiduciary only for any processing whose purpose it decides itself, such as its own marketing or product training.
Does the DPDP Act put obligations directly on data processors?
Mostly not. The Act makes the data fiduciary responsible for processing done on its behalf and lets it use processors only under a valid contract, so a processor's duties come from that contract rather than from the Act's penalty schedule.
What is a sub-processor?
A processor engaged by another processor. For a WhatsApp business, the BSP's cloud host, AI model provider or outsourced support desk are typical sub-processors; under the GDPR they need the controller's authorisation and the same contractual terms.
Is Meta a data processor for WhatsApp Cloud API messages?
Yes. When a business uses the Cloud API, Meta processes the message content as a data processor on the business's behalf and keeps message data for at most 30 days.

See InfiQ pricing

Put Data Processor to work

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms