processor

noun · Auftragsverarbeiter

The processor is the Auftragsverarbeiter, the body that processes personal data on behalf of the controller, Art. 4 Nr. 8 DSGVO, strictly bound by instructions. The word marks a subordinate role: whoever starts deciding on the purposes and means of the processing is treated as a Verantwortlicher for that processing, Art. 28 Abs. 10 DSGVO.

Which translation, when

Legaldefinition und Weisungthe role: the Auftragsverarbeiter processes personal data on behalf of the Verantwortlicher, Art. 4 Nr. 8 DSGVO, and only on the controller’s instructions, Art. 29 DSGVO; it has no say of its own on the purposes or the essential means, and that subordination is what separates it from a gemeinsam Verantwortlicher under Art. 26 DSGVO.

Auftragsverarbeitungsvertragthe paperwork: the processing must rest on a contract or other legal instrument with the mandatory content of Art. 28 Abs. 3 DSGVO, processing only on the controller’s documented instructions first among them, lit. a, in writing, and a further processor may be engaged only with the controller’s authorisation, Art. 28 Abs. 2 und 4 DSGVO; without a sufficient contract the arrangement itself is defective.

Rollenkippethe exzess: a processor that, in breach of the regulation, itself determines the purposes and means of the processing is treated as a Verantwortlicher in respect of that processing, Art. 28 Abs. 10 DSGVO, with the duties, the fines and the liability that follow; the classification is factual, so the same body can be processor for one operation and controller for another.

Why

The processor of the GDPR is the Auftragsverarbeiter, again a term fixed by the authentic German text, and the translation point is the shape of the role rather than the word. Art. 4 Nr. 8 DSGVO defines the Auftragsverarbeiter as the body that processes personal data on behalf of the Verantwortlicher; Art. 29 DSGVO binds it to the controller’s instructions, and Art. 28 DSGVO surrounds it with machinery, a mandatory contract with the content of Abs. 3, processing only on documented instructions first among them, written form, and the controller’s authorisation for engaging any further processor. What the Auftragsverarbeiter never does is decide on the purposes and means of the processing; that decision is the mark of the Verantwortlicher, and the two roles must not blur, since the overall responsibility and the accountability of Art. 5 Abs. 2 DSGVO stay with the controller even where the work is outsourced. The regulation polices the line with Art. 28 Abs. 10 DSGVO: a processor that in breach of the regulation itself determines the purposes and means is treated, for that processing, as a Verantwortlicher, so the subordinate role tips over into the full duty-bearing one, with fines and liability attached. The classification is factual, so the same body can be processor in one relationship and controller in another. A German reader will also stumble over false neighbours: a Prozessor is a chip, and a bare Verarbeiter is not the statutory term. So the safe rendering is Auftragsverarbeiter, and where the source shows a party actually deciding purposes and means, the translation should not soften that into the subordinate word.

Typical mistakes

The Auftragsverarbeiter acts on the controller’s instructions, Art. 29 DSGVO, documented by the contract, Art. 28 Abs. 3 lit. a DSGVO, and does not decide on purposes and means, so presenting it as a co-decider confuses it with a gemeinsam Verantwortlicher.
A processor that itself determines the purposes and means is treated as Verantwortlicher for that processing, Art. 28 Abs. 10 DSGVO, so the label in the contract does not settle the role.
A Prozessor is a chip and a bare Verarbeiter is not the statutory term, so only Auftragsverarbeiter carries the Art. 28 machinery.

What matters

Rendering an outsourcing or service arrangement, the translation should use Auftragsverarbeiter for the processor, keep the instruction-bound shape of the role visible, and reserve Verantwortlicher for the party that decides on the purposes and means, whatever the contract calls the parties.

Authority

Art. 4 Nr. 8 DSGVO
Art. 28 DSGVO

What the machine misses

Machine output may render processor as Prozessor in technical surroundings, a chip, or flatten it to Verarbeiter, which is not the statutory term. It also loses the shape of the role, the binding to the controller’s instructions under Art. 29 DSGVO and the tipping rule of Art. 28 Abs. 10 DSGVO under which a processor deciding purposes and means is treated as the controller. The rendering blurs who is subordinate and who bears the duties.

See what the machine does with this clause →

Examples

the processor processes personal data on behalf of the controller	der Auftragsverarbeiter verarbeitet personenbezogene Daten im Auftrag des Verantwortlichen
a contract between controller and processor	ein Vertrag zwischen Verantwortlichem und Auftragsverarbeiter
engaging another processor	die Inanspruchnahme eines weiteren Auftragsverarbeiters
on documented instructions	auf dokumentierte Weisung