A third party is any natural or legal person (other than the controller or processor) who receives personal data. GDPR requires that controllers provide transparency about third-party data access, the purpose, and ensure proper safeguards for such transfers.
