The person who processes personal data is either the data controller or the data processor. The data controller is the one who decides for what purposes the data is to be processed and how the processing is to take place. The personal data processor is the one who processes personal data on behalf of the data controller. If someone else than the data controller processes the personal data, there must be a written personal data processing agreement between them.