Under GDPR, any entity that processes data on behalf of the controller. Processing means anything you can do to data: store, send, calculate, print, or destroy it.
Want to actually apply concepts like this instead of just reading definitions?
Practice free on Zamlom