GDPR - am I the processor if I don&#39;t host the website?
<p>I work for a web development company and we are developing a web app for our client. The web app and database will be hosted on the client's server. Our involvement will just be to update the codebase and database schema as required.</p>

<p>For the purposes of GDPR, are we a data processor as we develop the web app?</p>

<p>If you merely <em>provide</em> software for your client to use, you are not processing personal data on behalf of the client.</p>

<p>But if you have access to systems that store personal data, then you must consider the GDPR. Or more accurately: your client must consider the GDPR. Under what legal basis can they give you access to the data in these systems? The easiest way to solve this is indeed if you act as the client's processor.</p>

<p>Processor status is never the default, but requires a binding contract with the data controller. This contract will require you to only process personal data as explicitly instructed by the client, and may require you to take certain security measures as a precaution. </p>

<p>Without such a contract you aren't a data processor, but possibly a data controller of your own (with all the compliance obligations that implies).</p>

gdpr