A processor is a party which processes personal data on behalf of another party, called the controller. Where (part of) the processing is outsourced by the controller to a processor, for instance to a cloud service provider, the controller can be considered the client and the processor the contractor. The processor may act only on the express instructions of the controller. In some cases, the processor may use a subcontractor, which is called a sub-processor. The terms of service between controller and processor are laid down in a data processing agreement.