I thought the processor was just someone who processes all personal data on behalf of the controller, basically a simple substitute for some matters. But from what I read online it seems that a processor is anyone that deals with any personal data, even partial data, as part of a service provided to the controller. So it sounds like everyone that deal with personal data as part of their job is a processor, except the end users of the service. But since processors must be bound by a specific contract to deal with the needs of the controller (article 28 says "processes the personal data only on documented instructions from the controller), then I'm afraid it will soon become a huge mess with a gazillion contracts to sign.
For example, John Doe has a website with a contact form. The contact form collects data, and the end user should accept the privacy policy written by John Doe. John Doe is the controller. However, John Doe's website is managed by a web agency! Is this web agency a processor? I guess so. So John doe needs to write a contract and have the web agency sign it. If every website owner does this, the web agency will have to read and sign hundreds of contracts. But the web agency hosts the sites on a web hosting provider, which in turn becomes another processor! And they use Gmail, provided by Google, which in turn is yet another processor that will have to sign millions of contracts. And so on, in an potentially endless cycle, just thinking that if you read your work email from your iPhone you might have to send a contract to Apple too.
It seems a huge mess to me, but I'm not sure I get it right. It looks like everyone is a processor except the end user, but the confusing thing is that the the law seems to say that it's the controller the one who decides the contractual terms, so it's not just a matter of accepting a privacy policy like we have been doing so far. So far, Google has provided a service to you, and you agreed to their privacy policy. Now it seems it's you, if you are a controller or a processor, that have to come up with a contract and Google has to accept it (if they want to). Like it's the other way around compared to the usual privacy policies. Of course this will probably never happen, and Google will probably come up with predefined contracts that both parties can agree on, but at that point what difference would there be between the contract required by GDPR and the usual privacy policies everyone has been using so far?
I hope the question is clear enough. I'm basically very confused about the actual role and duties of processors in real-world scenarios.
