What’s the difference between controller-to-processor vs processor-to-processor transfers?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Both refer to who's moving your subscriber data, and to whom. The distinction matters because each type of transfer carries different GDPR obligations.
Controller-to-processor: You (the data controller) share subscriber data with your ESP (the processor) so they can send campaigns on your behalf. This is the most common relationship. You need a Data Processing Agreement (DPA) in place, and your ESP must process data only according to your instructions.
Processor-to-processor: Your ESP (processor) shares data with one of their sub-processors, such as a cloud storage provider or analytics platform. Your ESP is still operating under your instructions, but the data has moved one step further. Both processors need appropriate safeguards, and your ESP is responsible for ensuring their sub-processors comply.
Where things get more complicated: if either transfer crosses borders (EU data going to a US company, for example), you need to ensure there's a valid legal mechanism in place. That might be Standard Contractual Clauses (SCCs), an adequacy decision, or binding corporate rules. Your DPA and your ESP's sub-processor list should document all of this.
If you're unsure whether your current ESP setup meets these requirements, our SOS hotline is a good place to start. We can walk through what's actually in your contracts.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
