A data processor (encargado del tratamiento) is the person or business that processes personal data on behalf of another, the controller (responsable del tratamiento), under GDPR Article 4(8). The controller decides why and how the data is used; the processor provides a service with it and follows the controller's instructions. A contract governs the relationship (Article 28).
In practice
The Spanish Data Protection Agency (AEPD) gives as an example a company that hosts information on its servers. In a small business, processors include your web host, your automation platform, the provider of your language model or the developer who maintains a system with access to customer data. In a Spanish owners' community (comunidad de propietarios), the AEPD's sector guide treats the community as the controller and the property manager (administrador de fincas) who runs it as the processor.
Article 28 sets out what the contract must say, and it must be in writing, which can be electronic. First, the subject matter, duration, nature and purpose of the processing, the type of data, the categories of people concerned and the controller's rights and obligations. Then, that the processor:
- Processes the data only on documented instructions from the controller, including for transfers to third countries.
- Ensures that the people handling it are bound by confidentiality.
- Applies the security measures in Article 32.
- Only engages another processor with the controller's authorisation.
- Helps the controller respond to people exercising their rights and comply with Articles 32 to 36.
- Deletes or returns the data when the service ends, as the controller chooses.
- Makes the necessary information available and allows audits.
Sub-processors. If the processor uses another one, such as a property manager bringing in an AI provider, it needs the controller's prior written authorisation, specific or general. Under a general authorisation, it must report each change so the controller can object (Article 28(2)). If the sub-processor fails, the original processor remains liable to the controller (Article 28(4)).
What Spanish law adds. Spain's data protection act (LOPDGDD) states that a processor's access to the data is not a disclosure, and that anyone listed as a processor who uses the data for their own purposes becomes a controller (art. 33). The GDPR says the same of a processor that determines the purposes and means (Article 28(10)).
We apply it to real cases in AI for property managers in Spain and what is n8n.
Common mistakes
- Using a free account with no contract. The AEPD's lab points out that a free account is not the same as a business account with contractual guarantees.
- Choosing without checking. Only a processor that offers sufficient guarantees will do (Article 28(1)), and the controller stays responsible: the AEPD speaks of a duty of special care in choosing and supervising it.
- Not checking where data is processed. If it leaves the European Economic Area, the transfer conditions in Chapter V of the GDPR apply.
- Forgetting the sub-processor. An AI agent or an n8n workflow can add several providers, and each needs its contract.
Sources
- Regulation (EU) 2016/679, the GDPR (EUR-Lex), Articles 4(8), 28 and 44
- Organic Law 3/2018, LOPDGDD (BOE, in Spanish), art. 33
- AEPD, guidelines for controller and processor contracts (in Spanish)
- AEPD, data protection and property management, sector guide under review (in Spanish)
- AEPD Lab, "Prompts, datos personales y confidencialidad", 25 August 2026 (in Spanish)
This definition explains the law as of the update date. It is not a substitute for advice from a lawyer on a specific case.