Knowledge · GDPR · Article 28
The data processing agreement, point by point.
A controller may only use processors that give sufficient guarantees, and the relationship must be governed by a binding contract that sets out what the processor may and must do.
GDPR art. 28Processor
What it requires
In plain words.
- Processing only on documented instructions from the controller
- Confidentiality for everyone processing the data
- Security measures in line with Article 32
- Sub-processors only with prior written authorisation, on the same terms
- Assistance with data subject rights and with Articles 32 to 36
- Deletion or return of all personal data when the service ends
- Information and audits to demonstrate compliance
Plain-language summary of GDPR Article 28 (Regulation (EU) 2016/679). Not legal advice – read the official text on EUR-Lex.
In practice
What it takes.
The hard part is not the template – it is knowing which suppliers process personal data, whether their agreements hold up, and when a sub-processor changes.
- Contract requirementsEach Article 28 term checked in your DPAs
- Supplier registerWho processes what personal data, linked to the agreement
- WorkflowSub-processor changes routed for approval
- EvidenceSigned DPAs and audit results with the supplier
How it runs in Paragraf – on the same foundation as your contracts and processes.
Next step
See GDPR article 28
with your own requirements.
Book a walkthrough. We show you the thread from this article to the Control, the owner and the evidence – in your own setup.