GDPR Article 4(8): a natural or legal person which processes personal data on behalf of the Controller, acting only on the controller’s documented instructions. Article 28 requires a written contract between controller and processor setting out the processing’s subject matter, duration and purpose, and this contract is typically where BCR or standard contractual clauses get incorporated for any Cross-border data transfer the processor carries out.