Article 28 — Processor Obligations

Legal Provision

Processor obligations: controllers must ensure processors offer sufficient guarantees, and the processing must be governed by a contract or legal act.

Scope

Applies to data controllers engaging data processors.

Requirement type

Duty: requires controllers to use only processors that provide sufficient guarantees of GDPR compliance and to formalize the relationship through a binding data processing agreement.

Actions to demonstrate compliance

A. Binary (yes/no)

• Signed Data Processing Agreement (DPA) covering Article 28.3 points.
• Documentation of due diligence performed on processor.
• Records of processing activities maintained by processor.

B. Non-Binary (requires contextual assessments

• Assessment of processor's technical and organisational measures.
• Evaluation of risks in subcontracting and cross-border transfers.
• Periodic audits and security testing outcomes.

Monitoring requirement

• Verification of written contract completeness (e/g/, annex mapping Article 28 elements)
• Periodic reviews and updates, Audits and inspections to confirm execution (security, instructions adherence, sub-processor compliance).

Consequences of non-compliance

• No valid legal basis for processing (violation of Article 28 (3) GDPR).
• Joint liability in case of unlawful processing: administrative fines under Article 83 GDPR.
• Regulatory sanctions.
• Business disruption and reputational damage.