Under GDPR, an organisation processing personal data on behalf of a data controller. Screening providers act as processors for employer clients.
