What is Processing on behalf?
Processing on behalf occurs when somebody processes personal data for you without deciding on the purposes and means themselves. The host, the newsletter sender, the analytics tool, the booking widget: all of them receive your customers' data and may only do with it what you say. You remain the controller. That is exactly why Art. 28(3) GDPR requires a contract setting out the subject matter, duration, nature and purpose of the processing, along with the categories of data subject and the processor's obligations.
In practice the contract is rarely a separate document. With the larger providers it sits ready as a clause in the terms and needs to be actively accepted once inside the account. This is the most common failure: the tool has been running for two years and the box was never ticked. Two neighbours need distinguishing. Anyone deciding on the purposes themselves is not a processor but a controller in their own right, an advertising platform using your data for its own models being the obvious case. And anyone deciding jointly with you is a joint controller under Art. 26 GDPR, which is a different type of contract.
The practical work is a list, not a legal opinion. You open your website with the network panel running, note every third-party domain, and hold the list against your contracts. Every line without a contract is either a missing tick or a service nobody needs any more. The second case is the better one: a deleted tool removes a consent, a contract, a line in the privacy notice and a little load time all at once.
Why does Processing on behalf matter?
The list almost always comes out shorter than feared and longer than remembered. According to the HTTP Archive, over 90 per cent of pages embed at least one third party, with a median of 79 requests to third-party hosts on mobile. Requests are not vendors: behind 79 requests there are often only five to fifteen companies. That number, not the request count, is your contract list, and it can be worked through in a morning.
Processing on behalf in practice
- 01A business has used a newsletter tool for three years but never accepted the contract sitting ready in the account. The processing has run without a legal basis ever since, although nothing is technically wrong.
- 02A map service was added for the directions page and has loaded on every page since. Rather than hunt for a contract it is replaced with a static image and a link: one service fewer on all three lists.
- 03An agency maintains a client's website through its own access. That too is processing on behalf and needs a contract, even though nobody exports any data.
