The GDPR does govern certain types of vendor relationships. In addition to the data controller, the GDPR recognizes the role of the “data processor” as a party that processes personal data on behalf and at the direction of a controller. In their processing activities, data processors must strictly abide by the instructions of the data controller. The GDPR establishes minimum requirements for the contract that a data controller must enter into with a data processor.