A data processor is a business that processes personal data on behalf of another. The other business, called the data fiduciary under India’s DPDP Act or the controller under the GDPR, decides why and how the data is used; the processor carries out that processing on its instructions. Email platforms, cloud hosting providers, payroll services and CRM tools are typical processors for their customers’ data.
Under the DPDP Act, a data fiduciary may engage a processor only under a valid contract, and the fiduciary stays responsible for compliance, including for what the processor does. The GDPR is more detailed: it lists what a controller–processor contract must contain, and it places some direct obligations on processors themselves, such as keeping records and securing data.
For a business choosing an email platform, this means asking practical questions. Where is the data stored? Who at the provider can access it? How are passwords and API keys protected? Can you export everything and delete contacts on request? Does the provider use sub-processors, and will it tell you about changes? A processor that can’t answer these clearly makes your own compliance harder.
The roles can also shift. A platform is a processor for the subscriber lists its customers upload, but a data fiduciary or controller for its own customers’ account details, billing data and its own marketing. The same company can hold both roles for different sets of data at the same time.
A Goa resort uses an email platform to send offers to past guests. The resort decides who to email and why, so it is the data fiduciary. The platform stores the list, sends the emails and records opens on the resort’s behalf, so for that list it is a data processor.
When you erase a contact in MailNesto, the contact and its activity are deleted and the address is kept on your suppression list, so it isn’t added back by a later import by mistake.