Data Processor

Also known as: Veri İşleyen, Service Provider

In short

The natural or legal person who processes personal data on behalf of the data controller, upon its authorisation and in line with its instructions.

Under the KVKK, a data processor is “the natural or legal person who processes personal data on behalf of the data controller upon its authorisation” (Art. 3). A processor does not process data for its own purposes but in line with the data controller’s instructions and on its behalf.

Who Are Data Processors?

Many of the services companies buy in involve data processing: cloud and hosting services, payroll and accounting firms, call centres, courier and logistics companies, HR software, e-mail marketing platforms and IT support providers are typical processors.

A company’s own employees are not processors; they act within the company’s organisation and on its behalf. Likewise, if a service provider starts using the data for its own purposes, for example using a customer list in its own marketing, it is no longer a processor for that processing but a separate controller.

Who Is Responsible?

Where data is processed by another person on its behalf, the data controller is jointly responsible with the processor for taking data security measures (KVKK Art. 12). Selecting and auditing the service provider and the contract concluded with it are therefore part of the controller’s own compliance. For a breach at a processor, the obligation to notify the Board and the data subjects also lies with the controller; see our guide Personal Data Breach: The First 72 Hours.

What Should a Data Processing Agreement Include?

Which data will be processed, for what purpose and for how long,
That the processor will act only on the controller’s instructions,
The technical and organisational measures to be taken and the controller’s audit rights,
Making the use of sub-processors subject to authorisation,
How quickly, and with what information, data breaches will be notified,
Return or deletion of the data when the service ends.

If the processor is located abroad or keeps the data on servers abroad, the rules on cross-border data transfers also apply, and in most cases standard contractual clauses must be signed.

Frequently Asked Questions

Is a contract with the processor mandatory?

The KVKK does not prescribe a specific form, but since the controller is jointly responsible with the processor for data security, setting out instructions, measures and breach notification in a written contract is indispensable in practice.

Must a processor register with VERBİS?

The VERBİS registration obligation is addressed to data controllers. A company is a processor when it processes data on behalf of another company, but a controller for its own employees' data.

← Glossary A–Z