A processor handles personal data on behalf of a controller. The ICO distinguishes this from deciding the purposes and means of processing. Assess what the organisation actually does rather than assuming every technology supplier has the same role. Source: ICO: controllers and processors

A travel example

Suppose a provider stores an agency’s enquiry records under the agency’s instructions. Ask whether it also uses information for separate purposes and assess those activities individually. This is an illustrative due-diligence question, not a conclusion about the provider’s legal role.

Make the arrangement clear

For a controller–processor relationship, the ICO requires a written contract. Ask the person responsible for data protection to check the proposed terms against the current official guidance. That guidance is marked as under review following the Data (Use and Access) Act 2025. Source: ICO: when a controller–processor contract is needed

Useful operational questions

Ask who can access the records, how additional providers are involved and what happens when the service ends. Request a demonstration of the agreed export or deletion process where appropriate. These questions connect the contract to the working service and give the agency something concrete to verify before adopting it.

Written and updated by Travelgenix. Sources checked on 16 October 2026. Worked examples and checklists are editorial illustrations and recommendations, not customer results.