Data processor — under GDPR Article 4(8), an entity that processes personal data on behalf of a controller, per the controller's instructions.
For Shopify merchants, processors include:
- Shopify itself (storing orders and customers)
- Klaviyo, Mailchimp, Omnisend (email)
- Gorgias, Tidio, Intercom (support)
- Yotpo, Judge.me (reviews)
- Loop, Returnly (returns)
- Most fulfilment apps
Each must have a signed DPA with you (most auto-execute via their Terms of Service).
Meta, Google, TikTok are NOT processors — they use received data for their own purposes (ad targeting, model training). They're co-controllers or recipients, not processors. This is why CPRA renamed "sale" to "sale or share" — sending data to Meta Pixel is sharing, not service-provider processing.
See also: GDPR, Data controller.