Most personal data now sits with processors, yet many controller-processor contracts still copy Article 28 word for word and leave the security detail, the sub-processor process and the audit right undefined. Article 28 of the General Data Protection Regulation (GDPR) sets what a controller must require of any processor, and the European Data Protection Board (EDPB) has said the contract should explain how those requirements will be met, not just restate them. This guide turns Article 28 into working terms for security and privacy teams: what each clause demands, what the security schedule should contain, how to run general or specific sub-processor authorisation, how to use audit rights and reports, and what processors carry in their own name. It is written for security, privacy, procurement and legal teams on both sides of the contract.
Sources: Regulation (EU) 2016/679 on EUR-Lex, EDPB Guidelines 07/2020 on the concepts of controller and processor (final version, dated 7 July 2021), and Commission Implementing Decision (EU) 2021/915, all checked in November 2026. Confirm against the official text before relying on it.
Key takeaways
- Article 28(3) is a minimum list, not a contract. The EDPB says the agreement should not merely restate the GDPR but give concrete detail on how each requirement will be met.
- Security belongs in a schedule. The contract should include or reference the technical and organisational measures, require approval before they change, and provide for regular review.
- Sub-processor authorisation is a choice to make explicitly. Specific authorisation needs approval for each change; general authorisation needs active notice of changes and a real chance to object.
- Audit rights must be usable. Reports and certifications help, but the controller decides the auditor, scope and method, and excessive audit fees that deter audits are not acceptable.
- Processors carry their own exposure. Breaches of processor obligations can be fined up to EUR 10 million or 2% of worldwide turnover, and a processor that sets its own purposes becomes a controller.
What Article 28 requires, clause by clause
Article 28(1) lets a controller use only processors providing sufficient guarantees of appropriate technical and organisational measures. Article 28(3) requires a contract or other legal act, binding on the processor, that sets out the subject matter, duration, nature and purpose of processing, the type of personal data, the categories of data subjects, and the controller's obligations and rights. Article 28(9) requires it in writing, which includes electronic form. The table shows what each point means for security teams.
| Provision | What the processor must do | Security and operational detail to agree |
|---|---|---|
| 28(3)(a) | Process only on documented instructions, including on third-country transfers, unless law requires otherwise (and then tell the controller first unless prohibited) | Where instructions are recorded (contract, annex, ticket), who may issue them, and how transfers are approved |
| 28(3)(b) | Ensure people authorised to process are bound by confidentiality | Staff and contractor confidentiality terms, access approval, leaver process |
| 28(3)(c) | Take all measures required by Article 32 | A security schedule of named measures, change approval, review cycle |
| 28(3)(d) | Respect the conditions in 28(2) and 28(4) for engaging another processor | Specific or general authorisation, notice period, objection steps, flow-down |
| 28(3)(e) | Assist with data subject rights requests, as far as possible | Request routing, response times, export and deletion tooling |
| 28(3)(f) | Assist with Articles 32 to 36: security, breach notification, DPIAs, prior consultation | Breach notice time, contact point and content; DPIA input |
| 28(3)(g) | Delete or return all personal data at the end of services, at the controller's choice, unless law requires storage | Deletion method, backups, confirmation of deletion and timescale |
| 28(3)(h) | Make available all information needed to demonstrate compliance, allow and contribute to audits including inspections, and immediately inform the controller of instructions it considers infringing | Report set, audit notice, on-site or remote, cost terms, escalation for unlawful instructions |
Article 29 adds that anyone acting under the authority of the controller or processor with access to personal data must not process it except on the controller's instructions, unless law requires it. Article 30(2) requires processors to keep their own records of processing for each controller, including where possible a general description of the Article 32(1) security measures. See the Data Mapping and ROPA Guide.
Writing the security schedule
Article 28(3)(c) points to Article 32, which requires measures appropriate to the risk, including as appropriate pseudonymisation and encryption, the ability to ensure ongoing confidentiality, integrity, availability and resilience, the ability to restore availability and access in a timely manner after an incident, and a process for regularly testing and evaluating the measures. The EDPB (paragraphs 126 and 127) says the contract must include or reference the measures in enough detail for the controller to assess them, that the controller sets the security objectives from its own risk assessment and approves the measures, that the processor needs approval before changing them, and that the measures may sit in an annex. The Commission's standard clauses use exactly that structure: Annex III, technical and organisational measures.
| Article 32(1) element | Schedule entries that make it testable |
|---|---|
| Pseudonymisation and encryption | Encryption in transit and at rest with named protocols, key ownership and rotation, where customer-managed keys apply |
| Confidentiality and integrity | MFA for staff access, privileged access management, least privilege, logging of access to customer data, secrets handling for service accounts and API keys |
| Availability and resilience | Backup frequency, immutable or offline copies, recovery time and recovery point objectives |
| Timely restoration | Restore testing frequency and evidence the controller may request |
| Regular testing and evaluation | Penetration testing cadence, vulnerability remediation timescales, independent assurance reports |
Machine credentials deserve a line of their own. A processor's API keys, service accounts and integration tokens often reach the controller's data directly, so the schedule should cover how they are issued, stored, rotated and revoked at the end of the contract. See Vendor contract clauses for credential revocation and breach notice.
Sub-processors: specific or general authorisation
Article 28(2) bars a processor from engaging another processor without the controller's prior specific or general written authorisation, and under general authorisation the processor must inform the controller of intended additions or replacements so the controller can object. Article 28(4) requires the same data protection obligations to be imposed on the sub-processor by contract or other legal act, and leaves the initial processor fully liable to the controller for the sub-processor's performance.
| Question | Specific authorisation | General authorisation |
|---|---|---|
| How a new sub-processor is approved | Controller approves each one in writing; an unanswered request counts as refused (EDPB para 155) | Processor notifies the change in due time; silence within the agreed period can count as approval (paras 156, 157) |
| What must be agreed up front | Approved list and the request period | Selection criteria, notice period, communication method and steps after an objection (para 158) |
| Standard clauses | Clause 7.7 Option 1 | Clause 7.7 Option 2 |
| Fits best | Bespoke services, high-risk or special category data, small supplier chains | Multi-tenant SaaS and cloud services with many customers and frequent changes |
| Main risk | Slow approvals that block the processor's operations | Notices nobody reads, so objections never happen |
The EDPB adds that the controller needs a list of intended sub-processors with their locations, activities and proof of safeguards before authorising (para 152), that accepted sub-processors should be listed in the contract or an annex and kept up to date (para 154), and that publishing a list is not enough: the processor must actively flag changes (para 128). Flow-down obligations, including audit rights, must match in substance, not word for word (paras 129, 160).
- Operate the notice process: route sub-processor notices to a named mailbox owned by privacy and security, review each within the objection period, and record the decision.
- Check transfers: a new sub-processor outside the EEA triggers Chapter V. The Commission's controller-processor clauses state they do not by themselves ensure compliance with transfer rules. See the International Data Transfers Map.
- Know the exit: agree what happens after an objection: the processor does not use that sub-processor for you, or you may terminate the affected service.
Audits, reports and inspections
Article 28(3)(h) requires the processor to allow for and contribute to audits, including inspections, by the controller or an auditor it mandates. The EDPB (paragraph 144) says the controller decides on the auditor, may contest the scope, method and results, and chooses between remote and on-site audits; paragraph 145 says audit costs are a commercial matter but clearly excessive fees that would deter audits are not acceptable. Paragraph 99 makes verification a continuing duty, not a one-time check at signing. Commission clause 7.6 lets the controller take account of the processor's relevant certifications and requires audit results to be available to the supervisory authority on request.
| Evidence | What it shows | Limits |
|---|---|---|
| ISO/IEC 27001 certificate and statement of applicability | A certified management system and which controls are in scope | Check scope covers the service and sites processing your data |
| SOC 2 Type 2 report | Controls tested over a period by an independent auditor | Read exceptions, carve-outs and complementary user entity controls |
| Security questionnaire answers | Self-declared position on specific controls | Unverified unless backed by evidence |
| Approved code of conduct or certification under Articles 40 and 42 | Article 28(5): an element to demonstrate sufficient guarantees | An element only, not proof on its own |
| Controller audit or inspection | Direct verification of your specific concerns | Cost, notice and confidentiality terms must be agreed |
A practical pattern is to accept reports and certifications as the routine evidence, and reserve an on-site or remote audit for high-risk processing, a serious incident, or indications of non-compliance. See How to Read a SOC 2 Report Guide and the Data Processor Due Diligence Questionnaire Template.
Breach notification and incident assistance
Article 33(2) requires a processor to notify the controller without undue delay after becoming aware of a personal data breach. The controller then has its own duty under Article 33(1): to notify the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals. The controller's clock is therefore what the contract has to protect.
- Notice time: the EDPB (paragraph 136) says the contract may set a specific timeframe, a contact point and minimum content. Agree a number of hours that leaves the controller time to assess and report, and treat it as a contract term, not a GDPR figure.
- Minimum content: Commission clause 9 requires at least the nature of the breach including, where possible, the data subjects and records concerned, a contact point, and likely consequences with measures taken or proposed. Information may be given in phases.
- Scope: the notice duty covers breaches in sub-processor systems too.
- Cooperation: logs, forensic findings and remediation status on request, and help with communications to individuals where Article 34 applies.
See the Third-Party Incident Notification Clauses Guide and the Data Breach Notification Checklist.
End of contract: deletion and return
Under Article 28(3)(g) the controller chooses between deletion and return. The EDPB (paragraphs 140 to 142) says the controller can change that choice before services end, deletion must be secure, the processor should confirm deletion within an agreed timescale and manner, and all copies must be deleted unless law requires storage, with either party telling the other promptly if such a requirement exists. Agree how backups are handled (for example, overwritten on their normal cycle and not restored), revoke the processor's credentials and integrations into your environment, and obtain written confirmation.
What processors carry in their own name
Article 28 is often read as a controller duty only. Processors have direct obligations and exposure.
| Provision | Processor exposure |
|---|---|
| Article 28(10) | A processor that determines purposes and means in breach of the GDPR is treated as a controller for that processing |
| Article 30(2) | Own records of processing for each controller |
| Article 32 | Security of processing applies to controller and processor |
| Article 33(2) | Notify the controller of breaches without undue delay |
| Article 82(2) | Liable for damage where it has not complied with obligations specifically directed to processors or has acted outside or contrary to lawful instructions |
| Article 83(4)(a) | Infringements of Articles 8, 11, 25 to 39, 42 and 43 can attract fines up to EUR 10,000,000 or 2% of total worldwide annual turnover of the preceding financial year, whichever is higher |
| Article 58(2) | Supervisory authorities can issue warnings, reprimands, compliance orders, processing limitations or bans, and fines to processors |
Processors should treat instructions as a control: the EDPB (paragraphs 146 to 149) expects the processor to inform the controller immediately of an instruction it considers infringing, and the parties to agree the consequences, such as suspension of the instruction or termination.
Standard clauses or your own contract
Article 28(6) and 28(7) allow the contract to rely wholly or partly on standard contractual clauses. The Commission adopted controller-processor clauses in Implementing Decision (EU) 2021/915 of 4 June 2021, under Article 28(7), with four annexes: list of parties, description of the processing, technical and organisational measures, and list of sub-processors.
Use the Commission clauses where many processors must be onboarded on consistent terms, accepting that the annexes still need real content. For large cloud and SaaS providers that will not negotiate, check their data processing agreement against the 28(3) table above and close gaps through order forms or security addenda. Keep bespoke terms for high-risk or special category processing. The UK GDPR keeps an equivalent Article 28 regime: see the UK GDPR and Data Protection Act 2018 Guide.
Implementing an Article 28 programme
- Inventory processors: list every supplier that processes personal data on your behalf, from the ROPA and procurement records, and rank by data sensitivity and volume.
- Gap-assess contracts: score each agreement against the eight 28(3) points, the security annex, the sub-processor model and breach notice terms.
- Fix high-risk gaps first: renegotiate or add addenda for the top tier at renewal or sooner where a gap is material.
- Set up operations: owners for sub-processor notices, an evidence calendar for reports and certificates, and breach contact points tested once a year.
- Verify periodically: review evidence annually for the top tier and on change, and audit where evidence is weak or an incident occurs.
- Close out properly: at exit, confirm deletion or return, revoke access and credentials, and update the ROPA.
Detection and measurement
- Contract coverage: share of processors with a signed agreement meeting all 28(3) points.
- Security annex quality: share of top-tier processors with a specific, approved technical and organisational measures annex.
- Sub-processor notices reviewed in time: share of notices decided within the objection period.
- Evidence freshness: share of top-tier processors with assurance reports or certificates less than 12 months old.
- Breach notice performance: time from processor awareness to controller notification in incidents and exercises.
- Exit completion: share of terminated processors with written deletion confirmation and revoked access.
Common failure patterns
- Restating the article: a contract that copies 28(3) with no security annex gives nothing to audit against, which the EDPB says is not enough.
- Unread sub-processor notices: general authorisation with notices sent to a procurement inbox nobody watches turns silence into approval.
- Audit right priced out: fees or notice terms that make audits impractical, contrary to EDPB paragraph 145.
- Breach clause without a clock: "without undue delay" with no hours, contact point or content leaves the controller's 72-hour assessment at risk.
- Exit without deletion evidence: data and access credentials left with a former supplier after the service ends.
- Processor drifting into controller: a supplier reuses customer data for its own product purposes and becomes a controller under Article 28(10) for that processing.
Framework mapping
| Framework | Reference | Link to Article 28 work |
|---|---|---|
| NIST CSF 2.0 | GV.SC-05 | Supply chain security requirements built into supplier contracts |
| NIST CSF 2.0 | GV.SC-07 | Supplier risks understood, recorded and monitored over the relationship |
| NIST SP 800-53 Rev. 5 | SA-9 External System Services; SR-6 Supplier Assessments and Reviews | Provider security requirements and ongoing supplier assessment |
| ISO/IEC 27001:2022 Annex A | 5.19, 5.20, 5.22; 5.34 Privacy and protection of PII | Supplier relationships, security in supplier agreements, monitoring supplier services, PII protection |
| CIS Controls v8.1 | Control 15 Service Provider Management | Inventory, classification and contract requirements for service providers |
Practitioner checklist
- List all processors from the ROPA and procurement, ranked by data sensitivity.
- Check each contract against all eight points of Article 28(3) and the subject matter, duration and data details.
- Attach a specific, approved security annex mapped to Article 32(1), with change approval and review.
- Choose specific or general sub-processor authorisation and set the notice period and objection steps.
- Route sub-processor notices to a monitored owner and record each decision.
- Agree breach notice hours, contact point and minimum content that protect the 72-hour window.
- Define the audit evidence accepted routinely and the triggers for a direct audit.
- Require written deletion confirmation and credential revocation at exit.
Standards and references
- EUR-Lex: Regulation (EU) 2016/679 (General Data Protection Regulation)
- EDPB: Guidelines 07/2020 on the concepts of controller and processor in the GDPR
- EUR-Lex: Commission Implementing Decision (EU) 2021/915 on standard contractual clauses between controllers and processors
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- ISO: ISO/IEC 27001:2022 Information security management systems
Related NHI Mgmt Group resources: Data Processor Due Diligence Questionnaire Template · GDPR Compliance Guide for Security Teams · GDPR Compliance Checklist · International Data Transfers Map. This guide summarises GDPR Article 28 and related processor obligations and is not legal advice.