Quick Answer
A CSV tool is likely a GDPR processor when it receives EU personal data on its servers and processes it on your instructions.
This triggers Article 28: you must have a signed Data Processing Agreement before processing begins — not after. Using a cloud CSV tool without a DPA may be a violation regardless of whether the data was misused.
The exception: A client-side tool that processes files in your browser, where no file contents reach any server, may not qualify as a processor for that activity — materially reducing or potentially eliminating the DPA obligation for raw file processing.
TL;DR: Under GDPR Article 28, any entity that processes personal data on your behalf is a processor — and you must have a Data Processing Agreement with them before processing begins. If a cloud CSV tool receives EU personal data on its servers and processes it on your instructions, it may be a processor. Using it without a DPA may be a violation of GDPR Article 28. Client-side tools that process files in your browser can materially reduce this exposure — for raw file contents that never reach a server, the processor relationship may not arise.
A startup used a popular online CSV tool to merge two customer lists before importing them to their CRM. The tool was fast, free, and well-reviewed. The lists contained names, email addresses, and purchase histories — standard EU customer data.
Three weeks later, a GDPR Subject Access Request came in from a customer asking which third parties had processed their data. The startup's data map listed their CRM, email platform, and payment processor. The CSV tool was not on it — because no one had thought to add it. It had never been through vendor due diligence. No DPA had ever been signed.
That CSV tool processed the customer's personal data. Under GDPR Article 4(8), it may have been a processor. Under Article 28, processing by a processor must be governed by a contract. The DPA that contract must take the form of was never executed.
The legal exposure is real and documented. In 2024, the Austrian DPA fined an organization for using a US-based analytics tool without adequate data processing safeguards — not because the data was misused, but because the contractual framework required by Article 28 was absent.
Regulatory requirements in this guide were verified against official GDPR text, the European Data Protection Board's guidelines on processors, and authoritative supervisory authority guidance. The vendor assessment framework in this guide reflects our direct experience evaluating the data handling architecture of CSV processing tools, March 2026.
Table of Contents
- The DPA Decision Flow: Does Your CSV Tool Need One?
- What Is a Data Processor Under GDPR Article 4(8)?
- When Does a CSV Tool Become a Processor?
- What a GDPR Article 28 DPA Must Contain
- How Client-Side Processing Changes the Article 28 Analysis
- Practical Steps for Assessing CSV Tools
- Additional Resources
- FAQ
This guide is for: Data Protection Officers, legal and compliance counsel, IT procurement teams, and anyone responsible for vendor due diligence under GDPR.
The DPA Decision Flow: Does Your CSV Tool Need One?
This table gives the framework. The legal classification of any specific tool requires analysis — but this decision flow covers the most common scenarios.
| Question | If Yes | If No |
|---|---|---|
| Does the tool receive the file on a remote server? | Likely a processor — DPA probably required | May not be a processor for raw file processing |
| Does the file contain EU personal data? | Article 28 analysis applies | GDPR may not apply to this processing activity |
| Does the tool process the file on your instructions? | Processor definition likely met | Tool may be acting as a controller in its own right |
| Does the tool offer a signed DPA? | Proceed after signing | Do not use for EU personal data without legal review |
| Does the tool explicitly process client-side with no server transmission? | Article 28 processor relationship may not arise for raw file processing | — |
Use this table as a starting point. Confirm the classification of any specific tool with qualified legal counsel.
Processor, Controller, or Neither? A Classification Matrix
This matrix gives DPOs a quick-reference tool for vendor classification. The final determination is always fact-specific — use this as a starting framework, not a legal conclusion.
| Tool Behavior | Likely Status | GDPR Obligation | What This Means in Practice |
|---|---|---|---|
| Receives file on server, processes on your instructions only | Processor | DPA required (Art. 28) | Must sign DPA before use; you control purposes |
| Receives file and also uses data for own purposes (training, analytics) | Controller or Joint Controller | Full controller duties; potentially needs its own legal basis | Cannot be used for EU personal data without separate legal review |
| Processes file client-side only — no server transmission of file contents | May not be a processor for raw file processing | DPA may not be required for that activity | Verify architecture with DevTools; confirm with counsel |
| Receives only anonymized data (all 18+ identifiers removed) | Not a processor for that data | No GDPR obligations for anonymous data (Recital 26) | De-identify first; then transmit |
| Receives metadata only (file name, size, operation type — no file contents) | Likely not a processor for file contents | Low risk; review what metadata is captured | Review privacy policy for telemetry scope |
The critical distinction between processor and controller: A processor acts on your instructions and for your purposes — you remain in control of why the data is processed. A controller determines the purposes independently. If a CSV tool uses your uploaded data to improve its own product, it may be acting as a controller for that secondary use, triggering obligations under GDPR Article 6 (lawful basis) that are separate from Article 28.
What Is a Data Processor Under GDPR Article 4(8)?
GDPR Article 4(8) defines a "processor" as "a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller."
Two elements must be present for the processor definition to apply. First, the entity must process personal data. Second, the processing must occur "on behalf of" the controller — meaning under the controller's instructions and for the controller's purposes.
When you use a CSV tool to clean, merge, or reformat a file containing EU customer data, and that tool processes the file on its servers according to your instructions, both elements are likely satisfied: the tool processes personal data, and it does so on your behalf to achieve your operational purpose.
The EDPB's Guidelines on the concepts of controller and processor clarify that the "on behalf of" element is met when an entity carries out processing activities as a service to a controller, where the controller retains control over the purposes of the processing. That describes exactly what a CSV tool does when it processes your customer data.
When Does a CSV Tool Become a Processor?
The legal determination is fact-specific, but the key questions are consistent across supervisory authority guidance.
Question 1: Does the tool process files on a remote server? If you upload a file and it is transmitted to a vendor's server for processing, the vendor's infrastructure is handling your EU personal data. This is the threshold condition for the processor analysis.
Question 2: Does the tool process the file on your instructions? CSV tools are designed to execute your specified operations on your data. The relationship is one of service — you instruct, the tool executes. This is the "on behalf of" element in Article 4(8).
Question 3: Does the tool's privacy policy or ToS reveal how the data is used? Some tools use uploaded data for purposes beyond the requested operation — training, analytics, service improvement. If a tool uses your data for its own purposes, it may be acting as a controller, not a processor. This distinction matters: a controller relationship does not require a DPA, but it creates different and potentially more serious GDPR obligations for the vendor.
Question 4: Does the tool offer a DPA? This is a practical proxy for the legal analysis. Legitimate SaaS processors typically offer DPAs because they understand their obligations under Article 28. A tool that does not offer a DPA may either be unaware of its GDPR obligations or may be deliberately avoiding the processor classification. Neither is a reassuring answer.
What a GDPR Article 28 DPA Must Contain
Article 28(3) specifies that the contract governing processor relationships must set out the subject matter, duration, nature, and purpose of the processing, the type of personal data, and the categories of data subjects. Beyond these basics, the DPA must stipulate that the processor:
- Processes personal data only on documented instructions from the controller — the processor cannot use your data for any purpose you have not authorized
- Ensures that persons authorized to process have committed themselves to confidentiality — the processor's staff must be bound by confidentiality obligations
- Implements all technical and organizational security measures required by Article 32
- Obtains prior written authorization before engaging sub-processors — and passes down equivalent DPA obligations to any sub-processor
- Assists the controller in responding to data subject rights requests — access, deletion, portability, rectification
- Assists the controller in ensuring compliance with security, breach notification, DPIA, and consultation obligations
- Returns or deletes all personal data after the service ends, at the controller's choice
- Makes available all information necessary to demonstrate compliance and submits to audits
Most CSV tool terms of service contain none of these obligations. A standard free-tier SaaS agreement is not a DPA. Signing a DPA means the processor has explicitly committed to each of these requirements in writing.
How Client-Side Processing Changes the Article 28 Analysis
The processor definition requires that the entity "process personal data." If no personal data ever reaches the vendor's infrastructure, the vendor may not be processing personal data on your behalf — and the Article 28 processor relationship may not arise for that activity.
Client-side CSV processing works as follows. When you open a file in a browser-based tool, the browser's File API reads the file from your local storage. A Web Worker thread — an isolated execution context within your browser, separated from any network connection — performs the processing operations. The results are written back to browser memory and made available for download. At no point does the file content leave your device.
For raw file contents that are processed entirely within this architecture, with no transmission to a remote server, the vendor does not process personal data on your behalf. The Article 28 processor analysis — which requires that the vendor process personal data — does not apply to that specific activity.
This analysis has limits. It applies to raw file processing only. Authentication, telemetry, crash reporting, and other tool functions may still involve server communication. Confirm with legal counsel that your specific tool's complete architecture supports the no-transmission conclusion before relying on it for compliance purposes.
Many CSV processing tools upload your file to remote servers. Many SaaS tools retain uploaded files temporarily for debugging, caching, or processing purposes — retention policies vary by vendor. For files containing EU personal data, this may create a processor relationship under GDPR Article 28, requiring a signed DPA before use. SplitForge processes files in Web Worker threads in your browser. For raw file contents, nothing is transmitted to any server — which can materially reduce Article 28 processor exposure for that specific activity.
Practical Steps for Assessing CSV Tools
Step 1: Determine whether your file contains EU personal data. Any file with information relating to identified or identifiable natural persons in the EU is covered by GDPR. Names, email addresses, account IDs, and behavioral data all qualify.
Step 2: Identify how the tool processes files. Is processing server-side (file transmitted to a remote server) or client-side (file processed in the browser without transmission)? The tool's privacy policy, architecture documentation, or a DevTools network verification can answer this question.
Step 3: If server-side, request a DPA before use. Contact the tool's DPO or legal team and request a Data Processing Agreement. If they cannot provide one, do not use the tool for EU personal data.
Step 4: Review the DPA against Article 28(3) requirements. A DPA that only says "we will keep your data secure" is not sufficient. The specific obligations listed in Article 28(3) must be addressed.
Step 5: Add the tool to your Records of Processing Activities. Article 30 requires controllers to maintain a record of processing activities. Every tool used to process EU personal data — including CSV tools — should appear in the RoPA with the DPA reference.
Step 6: Review sub-processor agreements. Article 28(2) requires the processor to obtain your authorization before engaging sub-processors. Ask the tool whether it uses sub-processors for file processing (cloud infrastructure, CDNs, etc.) and confirm those sub-processors are subject to equivalent DPA obligations.
What a Real Vendor Review Looks Like
This is what running the Article 28 assessment looks like for a typical cloud-based CSV processing tool. The tool name is generic — apply this framework to any vendor you are evaluating.
| Assessment Criterion | Typical Cloud CSV Tool | Client-Side Tool (e.g., SplitForge) |
|---|---|---|
| File processing location | Remote server (files transmitted on upload) | Browser only (no transmission for raw file contents) |
| DPA offered? | Often no; review ToS carefully | Not required for raw file processing |
| File retention period | Varies; many retain temporarily for debugging | Zero — file never reaches vendor infrastructure |
| Sub-processors | Cloud infrastructure (AWS, GCP, Azure) typically involved | None for file processing |
| GDPR Article 28 status | Likely a processor — DPA required before use | May not be a processor for raw file processing |
| Article 25 Privacy by Design | Using server-side tool when client-side alternative exists may be inconsistent | Client-side is the Privacy by Design implementation |
| RoPA entry required? | Yes — document tool, DPA reference, data categories | Document the tool; DPA entry may not be required |
| What to do if DPA unavailable | Do not use for EU personal data | Not applicable for raw file processing |
Practical outcome of this assessment: If you cannot obtain a DPA from a cloud CSV tool before use, and the tool receives EU personal data on its servers, you should not use it for that data. This is not a risk calculation — it is the requirement under Article 28.
Additional Resources
Official GDPR Regulation Text:
- GDPR Article 4 — Definitions (processor, controller, personal data) — Legal definitions of key terms
- GDPR Article 28 — Processor obligations and DPA requirements — Full text of Article 28
Supervisory Authority Guidance:
- EDPB Guidelines 07/2020 on Controller and Processor — Authoritative guidance on when processor status applies
- ICO Guide to Controller and Processor — UK supervisory authority analysis with practical examples
Standard Contractual Resources:
- European Commission Standard Contractual Clauses — SCCs for international transfers (related to Chapter V, distinct from Art. 28 DPAs)