A data processor is an organization or individual that processes personal data on behalf of a data controller, following the controller's instructions. Under GDPR Article 4(8), the processor has no independent authority over the purpose or means of processing — these are determined solely by the controller. Common data processors for website operators include analytics providers, email marketing platforms, cloud hosting companies, and cookie management vendors. GDPR Article 28 requires a written Data Processing Agreement (DPA) between every controller and processor. A processor that exceeds its authorized instructions and processes data for its own purposes becomes a data controller for that activity.