A retailer collects customer data and decides why and how it is processed. It contracts a cloud CRM vendor to process the data on its behalf, and that vendor engages a separate support firm that also handles the retailer's customer records. How should the support firm be classified?

Privacy frameworks distinguish the controller, which determines the purposes and means of processing personal data, from the processor, which processes that data on the controller's behalf and under its instructions. When a processor engages another party to carry out part of that processing, the new party is a subprocessor. Here the retailer is the controller, the CRM vendor is the processor and the support firm brought in by the vendor is the subprocessor, which typically requires the controller's authorization and flows down the same contractual protections. Calling the support firm a controller fails because it does not decide why or how the customer data is processed; handling records under someone else's instructions is processing, not control. Ownership is an internal accountability role, and holding a copy of the data on its own systems does not give a service provider authority over classification or access. A data steward is an internal role focused on data quality, definitions and metadata, not a contractual position in the processing chain. Exam caveat: the label depends on who determines purpose and means, not on who stores or touches the data. Operational check: confirm the CRM contract lists the support firm as an approved subprocessor, that the retailer was notified of it, and that equivalent data protection terms apply to it.