# Definitions 4(8) — GDPR — provision context

> Focused context for a single provision (4(8)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-4#par-8
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Definitions** (GDPR, full article: https://overview.legal/laws/gdpr/art-4).

## Provision text

### 4(8)

‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;


## Topics on this provision

- **Public Authority** — https://overview.legal/topics/overheid
  Government bodies and their data processing activities
- **Public Sector** — https://overview.legal/topics/public-sector
  Processing by public authorities
- **Processors** — https://overview.legal/topics/processors
  Entities that process data on behalf of controllers
- **Personal Data** — https://overview.legal/topics/persoonsgegevens
  Information relating to identified or identifiable natural persons
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing

## Cited by (exact-provision citations)

- **Judgment of the Court (Grand Chamber) of 5 December 2023.#Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija.#Request for a preliminary ruling from the Vilniaus apygardos administracinis teismas.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(2) and (7) – Concepts of ‘processing’ and ‘controller’ – Development of a mobile IT application – Article 26 – Joint control – Arti** (case-law) — https://overview.legal/posts/132280
- **Judgment of the General Court (Tenth Chamber, Extended Composition) of 3 September 2025.#Philippe Latombe v European Commission.#Transfer of personal data to the United States – Commission Implementing Decision on the adequate level of protection of personal data ensured by the United States – Right to an effective remedy – Right to private and family life – Decisions based solely on the automated processing of personal data – Security of the processing of personal data.#Case T-553/23.** (case-law) — https://overview.legal/posts/132137
- **LG Rostock - 3 O 762/19** (case-law) — https://overview.legal/posts/122848
- **Judgment of the Court (Grand Chamber) of 5 December 2023.#Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija.#Request for a preliminary ruling from the Vilniaus apygardos administracinis teismas.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(2) and (7) – Concepts of ‘processing’ and ‘controller’ – Development of a mobile IT application – Article 26 – Joint control – Arti** ¶83 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132280
- **Judgment of the Court (Grand Chamber) of 5 December 2023.#Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija.#Request for a preliminary ruling from the Vilniaus apygardos administracinis teismas.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(2) and (7) – Concepts of ‘processing’ and ‘controller’ – Development of a mobile IT application – Article 26 – Joint control – Arti** ¶22 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132280
- **Judgment of the General Court (Tenth Chamber, Extended Composition) of 3 September 2025.#Philippe Latombe v European Commission.#Transfer of personal data to the United States – Commission Implementing Decision on the adequate level of protection of personal data ensured by the United States – Right to an effective remedy – Right to private and family life – Decisions based solely on the automated processing of personal data – Security of the processing of personal data.#Case T-553/23.** ¶172 (case-law, General Court) — https://overview.legal/posts/132137
- **Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)** (guidance) — https://overview.legal/posts/38074
- **Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation** (guidance) — https://overview.legal/posts/51268
- **Guidelines on processing of personal data through blockchain technologies** (guidance) — https://overview.legal/posts/125668
- **Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)** (guidance) — https://overview.legal/posts/125715
- **Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria** (guidance) — https://overview.legal/posts/125831
- **Guidelines on processing of personal data through blockchain technologies** §42 (guidance, EDPB) — https://overview.legal/posts/125668

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-4#par-8 · 2026-08-22