I work for a web development company and we are developing a web app for our client. The web app and database will be hosted on the client's server. Our involvement will just be to update the codebase and database schema as required.

For the purposes of GDPR, are we a data processor as we develop the web app?

2 Answers 2


If you merely provide software for your client to use, you are not processing personal data on behalf of the client.

But if you have access to systems that store personal data, then you must consider the GDPR. Or more accurately: your client must consider the GDPR. Under what legal basis can they give you access to the data in these systems? The easiest way to solve this is indeed if you act as the client's processor.

Processor status is never the default, but requires a binding contract with the data controller. This contract will require you to only process personal data as explicitly instructed by the client, and may require you to take certain security measures as a precaution.

Without such a contract you aren't a data processor, but possibly a data controller of your own (with all the compliance obligations that implies).


If you have developed the Software and will continue to render support services to that software you also have access to the Data, therefore you act as a Processor (it's not a matter of you deciding or not to access it, it's a matter of having the possibility to access the Data).

If you have developed the Software and will never again "interact" with it, then you are not a Processor nor Controller.

Now speaking of Controller, if the software was developed under Client instructions, the Client is the Controller, however if you have a software suite that enables by default some features and the Client may chose some or all + you maintain the tool (support services), then you are in fact a Co-Controller (not just a Processor).

You really should do your own internal operational assessment, unless this is the only client you have.

Opposite to what Amon just said, Processor Status does not require a Contract with the Controller... you can be a Processor with no Contract whatsoever, be very careful with that... now this means that you should (must) have a contract so that both parties are "protected"... if there is no contract both companies are breaching GDPR (if GDPR is applicable of course).

Be very careful with the remark ".. without such contract you are not a Data Processor..." it's not a matter of contract... it's about WHAT you effectively DO!

  • I write and maintain software, but neither I nor my employer has access to the data. On rare occasions the client makes copies of some part of the data and provides them to us. We have no direct access otherwise. Thus we would not be processors if the GDPR applied, which it doesn't (all clients are US-based), Commented Jul 10, 2019 at 16:24
  • 1
    Yes, if you do not have access to the Data you are not a Processor... however if you may have access to the Data being hosted (meaning you have the means to do it) then you are a Processor no matter if you like it or not... and if you insist you are not, you are just rendering your Corporate Clients at risk. Commented Jul 11, 2019 at 18:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .