Are data processors really immune from data protection fines under GDPR?

When do regulators choose to go after data processors instead of data controllers? 

What matters

Fines for data processors, rather than data controllers, have been few and far between. But this is likely to change.

What matters next

Consideration of processor location, contract terms and size will be increasingly important to manage controller risk when procuring data processing services.

Previous European data protection

Free Trial

Register for free to keep reading.

To continue reading this article and unlock full access to GRIP, register now. You’ll enjoy free access to all content until our subscription service launches in early 2026.

  • Unlimited access to industry insights
  • Stay on top of key rules and regulatory changes with our Rules Navigator
  • Ad-free experience with no distractions
  • Regular podcasts from trusted external experts
  • Fresh compliance and regulatory content every day
Register for free Already a member? Sign in