You asked
Under the upcoming GDPR, a data processor is classed as:
'person or organisation who operates on or uses data for business purposes.'
The ONS sends out Business Register and Employment Surveys annually; does this make the ONS a third party to my company, and thus a data processor, since the data in the survey has been given to be under the consent of my employees?
We said
Thank you for your request.
A 'processor' as defined under the GDPR is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
In the Business Register and Employment Surveys example, we are not processing the data on behalf of your company but rather for our own statistical purposes. We would therefore be a data controller, rather than a data processor.