Article 28 GDPR: Data Processing Agreement & Mandatory Clauses

Operational Checklist of Mandatory DPA Clauses (Art. 28.3 GDPR)

The Data Processing Agreement (DPA) or equivalent legal act must be in writing (including electronic format) and be legally binding on the processor with regard to the controller. In accordance with Article 28(3) GDPR and EDPB Guidelines 07/2020, the contract must stipulate the following core terms:

• Contractual framework (Art. 28.3 intro): Specify the subject-matter, duration, nature and purpose of processing, type of personal data, categories of data subjects, and the obligations and rights of the controller.
• 1. Documented instructions (Art. 28.3.a): Process data only on documented instructions from the controller (including international transfers), unless required to do so by EU or Member State law.
• 2. Staff confidentiality (Art. 28.3.b): Ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation.
• 3. Security measures (Art. 28.3.c & Art. 32): Take all technical and organisational measures necessary to ensure a level of security appropriate to the risk.
• 4. Sub-processors (Art. 28.3.d): Adhere strictly to prior written authorization requirements (specific or general) and flow down identical mirror obligations into sub-processor contracts.
• 5. Assisting with data subject rights (Art. 28.3.e): Assist the controller by appropriate technical and organisational measures in fulfilling the obligation to respond to requests for exercising data subject rights (Chapter III).
• 6. Assisting with security, breach notification & DPIAs (Art. 28.3.f): Assist the controller with security compliance, notifying data breaches without undue delay (Art. 33.2), communication to data subjects, and DPIAs (Articles 35-36).
• 7. Deletion or return of data (Art. 28.3.g): At the choice of the controller, delete or return all personal data upon end of provision of services, unless storage is required by law.
• 8. Audits and immediate alert duty (Art. 28.3.h): Make available all information necessary to demonstrate compliance, allow for and contribute to audits/inspections, and immediately inform the controller if an instruction infringes EU or national data protection law.

Sufficient Guarantees & Sub-Processing (Art. 28.1 & 28.2)

Controllers must only use processors providing « sufficient guarantees » to implement appropriate technical and organisational measures. If a processor determines purposes or means independently outside controller instructions, it becomes a controller de facto under Article 28(10).

The European Commission's Standard Contractual Clauses (Decision EU 2021/915) offer an official non-mandatory template model for Article 28 compliance.

IQVIA — Supervisory authority decision — Italy (23 September 2026)

The Garante treats IQVIA as controller from collection because it determined the purposes and means of the LPD project (§§ 68–81). Doctors remain controllers for patient care; for project operations performed on behalf of IQVIA, the authority requires processor appointments if that activity continues (§ 144). Roles depend on the facts and each processing operation.

• Findings concern the database and operations examined; qualification must be assessed for each processing operation.

Decision no. 710, subject to judicial challenge; no filed appeal confirmed in the official sources consulted as of 11 October 2026.

Verified Official Sources

Associated Operational Micro-Tools

See Also in the Legal Framework