GDPR Article 28: a checklist for the data processing agreement

Article 28 applies when processing is carried out on behalf of a controller. Paragraph 3 then requires a contract or another legal act, and paragraph 9 requires it to be in writing, including in electronic form.

The French data protection authority (Commission nationale de l’informatique et des libertés, CNIL) states that this classification also applies to a “turnkey” solution, as long as the organization actually processes personal data. Occasional access, for example for maintenance, may be enough. The parties cannot choose the classification that suits them: it depends on the reality of the processing.

This list follows paragraph 3 of Article 28. It lets you check that the required provisions are present. It does not replace an analysis of your contract, and it does not suggest any drafting.

Description of the processing:

• its subject matter and duration;
• its nature and purpose;
• the type of personal data;
• the categories of data subjects;
• the obligations and rights of the controller.

Processor commitments:

• Instructions: process the data only on documented instructions, including for transfers outside the Union.
• Confidentiality: ensure that authorized persons have committed to confidentiality.
• Security: take the measures required by Article 32.
• Sub-processors: comply with the conditions of paragraphs 2 and 4.
• Data subject rights: help the controller respond to requests.
• Assistance: help the controller with Articles 32 to 36, including security, breaches and impact assessments.
• End of services: delete or return the data, at the controller’s choice, and destroy existing copies, unless there is a legal retention obligation.
• Evidence and audit: provide the necessary information and allow audits, including inspections.

The processor must also immediately inform the controller if it considers that an instruction infringes data protection law.

The CNIL asks that the provisions of Article 28(3) be included and adapted to the parties’ situation. A copy that does not describe the actual processing gives little to work with if a question arises. Several of its points of attention are practical:

• the scope set by the contract frames the processing: an operation not provided for should, in principle, be renegotiated or at least covered by written instructions;
• the contract can specify whether authorization for sub-processors is given case by case or generally;
• the controller’s instructions are best written down and recorded;
• the arrangements for assistance with data subject rights should be organized as soon as the contract is signed.

These recommendations appear in a CNIL publication based on checks carried out on 15 online service providers, as part of its 2019 priority inspections. They predate the 2021 standard clauses, but remain useful for reviewing a contract.

The processor cannot engage another processor without the prior specific or general written authorization of the controller. With a general authorization, it must inform the controller of any intended addition or replacement, so that the controller can object.

The same data protection obligations must be imposed on the sub-processor. If the sub-processor fails to meet them, the initial processor remains fully liable to the controller.

The European Data Protection Board clarified these points in its Opinion 22/2024, in October 2024. The controller must have the identification details of all processors and sub-processors available at all times. Verifying their guarantees applies whatever the risk, even if its extent may vary. The controller is not required to systematically request the contracts along the chain, but it must assess whether it needs them to demonstrate compliance.

Implementing Decision (EU) 2021/915 of 4 June 2021 published standard clauses between controllers and processors. It states that they meet the requirements of Article 28(3) and (4).

The CNIL points out that they are not mandatory if the contract already contains all the required elements. Three points deserve attention:

• Modification: the parties undertake not to modify the clauses, except to complete the annexes. They can include them in a broader contract or add safeguards, provided these do not contradict them.
• Annexes: four annexes describe the parties, the processing, the security measures and, in the case of specific authorization, the sub-processors. The decision requires a concrete, not generic, description of the security measures.
• Transfers: according to the CNIL, these clauses are not used to govern a transfer outside the Union. Other standard clauses exist for that purpose.

They therefore provide a complete basis, but their practical value depends on the care taken with the annexes.

The GDPR sets the principle without putting a number on the processor’s deadline: Article 33(2) requires it to notify the controller of any breach without undue delay after becoming aware of it. The controller, for its part, has its own obligations to notify the supervisory authority.

The standard clauses follow the same logic. They list the minimum content of the notification: the nature of the breach, a point of contact, the likely consequences and the measures taken or proposed. The information may be provided in phases.

The review does not stop at signature. A list of sub-processors changes, a security annex ages, a scope expands through a contract amendment. A renewal or a new service are natural opportunities to review these elements.

Article 83(4) provides for fines of up to €10 million or 2% of total worldwide annual turnover, whichever is higher, for the obligations under Articles 25 to 39. Both the controller and the processor are covered. Whether a fine is imposed and its amount depend on the circumstances.

Article 82 also gives data subjects a right to compensation. A processor is liable for damage in particular if it has failed to meet its own obligations or acted outside the controller’s lawful instructions.

Docform acts as a processor for its customers, who are the controllers. A DPA (Data Processing Agreement) is available on request, and the Trust page lists its sub-processors. For your own contracts, the contract repository centralizes data processing agreements and their amendments, and reminders flag end dates and notice dates. Your team can turn its requirements into contract playbook rules: the assistant flags deviations, citing the source passage, and the lawyer decides.