Q: What happens when publishers outsource data services?

A: GDPR identifies a “Data Controller” and a “Data Processor”. The Data Controller is the entity that determines the purposes, conditions, and means of processing personal data. The Data Processor processes personal data on behalf of the Data Controller.