Fiche 26/54
Part 3 — Lawfulness & Key Actors
Advanced
Reviewed 2026-08-23
Subcontracting & Data Processing Agreements (Art. 28)
Subcontracting & Data Processing Agreements (Art. 28)
⚡ In 30 seconds
Under Article 28, processing by a processor must be governed by a binding contract in writing (DPA). The contract sets out the subject-matter, duration, nature and purpose of processing, types of personal data, categories of data subjects, and the specific statutory obligations defined in Article 28(3).
| Mandatory Clause (Art. 28.3) | Contractual Safeguard Requirement |
|---|---|
| (a) Documented Instructions | Processes personal data solely on documented controller instructions, including on international transfers. |
| (b) Confidentiality | Ensures that persons authorized to process data have committed themselves to statutory or contractual confidentiality. |
| (c) Security Measures | Implements all appropriate technical and organizational measures required under Article 32. |
| (d) Sub-processor Rules | Does not engage another processor without prior specific or general written authorization of the controller. |
| (e) Assisting Rights | Assists the controller by appropriate measures in responding to data subject rights requests (Chapter III). |
| (f) Assisting Compliance | Assists the controller in ensuring compliance with Articles 32 to 36 (security, breach notifications, DPIAs). |
| (g) Deletion or Return | At the choice of controller, deletes or returns all personal data after the end of the provision of services. |
| (h) Audits & Inspections | Makes available all necessary information and allows for audits, including inspections, conducted by controller. |