A processor that another processor engages to carry out processing for a controller, such as the model host behind an AI vendor. Under GDPR Article 28 it needs the controller's prior written authorisation, specific or general with notice of changes and a chance to object, and the same data protection obligations flow down to it by contract 1.
- Developed in
- ch. 19, AI vendor DPAs and no-training clauses
ch. 15, Vendor contracts and licence terms - Chapters
- ch. 08, Regulatory Map · ch. 12, Governance Program · ch. 15, Deployment · ch. 19, Privacy & AI
- Contrast with
- Controller and processor
- Source
- 1 numbered reference, listed below
Where it is used
4 chapters of the Body of Knowledge use the term. Each link opens the first section that does.
- 08 · Regulatory Map Data protection and other EU law 2 mentions
- 12 · Governance Program Third-party AI policy 1 mention
- 15 · Deployment Model types and deployment options 6 mentions
- 19 · Privacy & AI Controller duties across the AI supply chain 2 mentions
Patterns that use this term
One pattern page uses the term.
- Vendor / Model Due-Diligence Gate 2 mentions
Sources
- [1] Regulation (EU) 2016/679 (General Data Protection Regulation) (Arts. 4(1), 4(5), 4(7), 4(8), 4(12), 4(14), 5, 6, 9, 12(3), 22, 25, 28(2) and 28(4), 30, 33, 35; Recital 26). Publications Office of the EU (EUR-Lex). 2016-04-27. https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng (verified: primary)
Definitions of legal terms paraphrase the cited text, which governs. Dated statements are as of .