"In the GDPR world we'll all be living in after 25 May, it's simple: if the data controller tells a third-party data processor (to which it has provided data) that consent no longer exists for the party to hold that data and to delete it, then they have to do it. And as long as the controller made reasonable efforts to ensure that this is done, it's the third party that carries the can."
It's not that simple. You've assumed that consent is used as the basis for processing, but data processors are often engaged to form a contract between the subject and the controller e.g. a ticket sale for an event. If consent was not basis for processing, removal of consent is not applicable.
Biting the hand that feeds IT
