A business example
A company sends payroll data to a service provider that calculates salaries according to its instructions.
Company instructions
The employer defines the agreed payroll purpose and inputs.
Provider activity
The vendor processes the data to perform the instructed service.
Scope boundary
Any proposed use for the vendor's own separate purposes needs a distinct assessment.
What this shows
Being a processor for payroll does not describe every possible use of the same information. The actual activity and instructions matter.
What it is often confused with
A provider can have different roles for different activities; a contract label alone does not settle all processing.
What to look at in your business
Describe the processing scope, instructions, security and deletion arrangements.
Context and further reading
MeitY: Digital Personal Data Protection Act, 2023. This reference supports the terminology; use the linked guide for applicability and operative requirements.
Kosha.Services · Updated 2 October 2026