The glossary to understand and take action

Processor within the meaning of the GDPR

The processor processes personal data on behalf of a controller, within the framework of the applicable instructions and conditions.

Notion comptable, fiscale ou juridique · Luxembourg Fiduciaries Editorial Team · Reviewed on

Understand the scope

Definition and points to distinguish

The role is determined by the actual processing operations. A firm may have different roles depending on its processing activities; contracts, access rights, security measures and use of other service providers must reflect this analysis.

In your file

What this changes in practice

A processor processes personal data on behalf of a controller, in accordance with its instructions. The classification depends on the actual role, not solely on the contract title. The agreement must govern instructions, confidentiality, security and the use of other processors in accordance with applicable requirements. A business must be able to understand where its data goes and how it will be returned or deleted.

A scenario to help you understand

Educational example

A company uses a service provider to manage payroll. It analyses the roles and frames the processing of employee data in the appropriate agreement.

Fictitious situation, presented to illustrate the concept.

Prepare for what comes next

Points to check

  • Qualifier les rôles réels
  • Encadrer les instructions et la sécurité
  • Prévoir la sortie et les sous-traitants ultérieurs

The practical question

Find out more

Un prestataire informatique est-il toujours sous-traitant au sens du RGPD ?

Le rôle dépend de ce qu’il fait réellement et des décisions qu’il prend sur les finalités et moyens du traitement. La qualification doit être analysée pour la prestation concernée. Une même relation peut comporter des rôles différents selon les traitements. Le contrat doit refléter cette analyse plutôt que reprendre automatiquement une étiquette standard.

Connecting concepts

Terms to know as well

Continue with the concepts, contacts and procedures related to this topic.

GDPR — protection of personal dataThe General Data Protection Regulation governs the processing of personal data within its scope of application.Data minimisationA principle consisting of limiting the personal data used to what is necessary for the intended purpose.Reversibility of accounting dataReversibility refers to the ability to retrieve the documents and data needed to continue management with another tool or service provider.National Commission for Data Protection (CNPD)The CNPD is Luxembourg's data protection supervisory authority. It provides information, carries out supervision and, in particular, handles complaints within its area of competence.Notification of a personal data breachA data breach may affect the confidentiality, integrity or availability of data. The controller must assess the incident and the notification obligations provided for by the GDPR.Reporting OfficeThe Reporting Office provides information and guidance in connection with the protection of persons reporting breaches of law. Its role forms part of Luxembourg's whistleblower protection framework.

Put it into practice

Explore further with our guides

Practical guideGDPR-CARPA: understanding the scope of GDPR certificationPractical guidePersonal data and fiduciary services: governing document exchanges

Sources and verification

References consulted on 20 September 2026. Official procedures specify the applicable conditions and exceptions.

This guide explains a general process. The applicable rules depend on your situation; it does not constitute personalised advice. Report a correction.

A definition gives you a reference point. To examine your situation, clarify your question with a professional.