GDPR Article 28: DPA Requirements, Sub-Processors, and Audits

GDPR Article 28 governs the relationship between a company that controls personal data and any outside vendor it hires to process that data. It requires a binding written contract with specific mandatory terms, imposes direct operational duties on the processor, and exposes both parties to fines of up to €10 million or 2% of worldwide annual revenue, whichever is higher, when its rules are ignored.¹

When Article 28 Applies

Article 28 is triggered whenever a controller hands personal data to a processor. The controller decides why and how personal data gets processed. The processor handles data on the controller’s behalf and follows the controller’s instructions.² Cloud hosting, payroll services, marketing analytics platforms, and any other vendor that touches personal data belonging to EU residents falls inside the rule.

Geography does not narrow it much. Under Article 3, the GDPR applies to processors anywhere in the world when the processing relates to offering goods or services to people in the EU or monitoring their behavior in the EU.³ A US SaaS provider storing data for EU customers needs an Article 28 contract just as much as one based in Berlin.

Two boundary points are worth flagging. If two organizations jointly determine the purposes and means of processing, they are joint controllers under Article 26, and they need a different kind of agreement that allocates responsibilities and lets individuals exercise their rights against either party.⁴ And under Article 28(10), a processor that starts deciding the purposes and means of processing on its own is automatically reclassified as a controller for that processing, inheriting full controller liability.² Labels in a contract don’t override facts on the ground.

What the Data Processing Agreement Must Contain

Article 28(3) requires a written contract, commonly called a Data Processing Agreement or DPA. Electronic form counts. At a minimum, the contract has to describe:²

The subject matter and duration of the processing
The nature and purpose of the processing
The types of personal data involved
The categories of data subjects (customers, employees, website visitors, and so on)
The obligations and rights of the controller

On top of those descriptors, the DPA has to bind the processor to the operational duties set out in Article 28(3)(a) through (h). Article 28(6) allows the whole DPA, or parts of it, to be built on standard contractual clauses adopted by the European Commission or a supervisory authority, which is why many organizations use the Commission’s SCCs as their base document.

The Processor’s Operational Duties

Act Only on Documented Instructions

The processor may process personal data only on the controller’s documented instructions, including any transfers outside the EU.² If local law forces the processor to act outside those instructions, it must tell the controller before doing so, unless that law forbids the notification. Once a processor starts using data for its own purposes, feeding it into its own AI training, running internal analytics, it has crossed into Article 28(10) territory and picked up controller-level exposure.

Confidentiality

Everyone the processor authorizes to handle the data must be under a confidentiality commitment or a statutory duty of secrecy.² Employees, contractors, temporary staff, anyone with access: they all need to be covered.

Security Measures

The processor must implement technical and organizational measures appropriate to the risk, as required by Article 32. Those measures include pseudonymization and encryption of personal data, ongoing confidentiality, integrity, availability, and resilience of processing systems, the ability to restore access to personal data after a physical or technical incident, and a process for regularly testing the effectiveness of the measures.⁵

These are risk-based obligations. The controller and processor have to weigh the state of the art, implementation costs, and the severity of the risks to individuals. Contract language that just references “industry standard security” won’t hold up; the agreement needs enough specificity that both parties, and a regulator, can judge whether the protections fit the risk. Adherence to an approved code of conduct under Article 40 or a certification under Article 42 can serve as evidence of the sufficient guarantees Article 28 requires.² ISO 27001 is widely accepted as relevant evidence, though certification alone doesn’t automatically satisfy every GDPR obligation.

Help With Data Subject Rights

Individuals have the right to access, correct, delete, and restrict processing of their data. Because the processor is holding the data, the controller usually can’t answer those requests without help. The DPA has to require the processor to assist in responding within the deadlines the GDPR imposes.² In practice, that means the processor’s systems must be able to locate, export, modify, or delete a specific individual’s data on request.

Notify the Controller of Breaches

When the processor discovers a personal data breach, it must notify the controller without undue delay.⁶ Speed is the point. The controller has only 72 hours from awareness of a qualifying breach to notify its supervisory authority, so any lag at the processor eats into that window. The DPA should specify the communication channel, the information the processor has to provide, and the escalation procedure.

Assist With DPIAs and Prior Consultation

The processor must also help the controller with data protection impact assessments for high-risk processing and, where needed, provide the technical information the controller needs for prior consultations with supervisory authorities.²

Return or Delete Data at the End

When the services end, the processor must either delete the personal data or return it to the controller. The controller chooses. Existing copies have to be destroyed unless EU or member state law requires retention.² Holding data “just in case” after termination is a violation, and it’s one of the easier things for a regulator to spot in an audit.

Sub-processors

A processor can’t bring in another processor without the controller’s prior written authorization. That authorization can be specific to a named vendor, or general to a category of vendors.² When authorization is general, the processor still has to notify the controller before adding or replacing any sub-processor, giving the controller a chance to object. DPAs commonly build in a 30 to 60 day notice window.

When a sub-processor is engaged, the processor must impose the same data protection obligations on it through a binding agreement. If the sub-processor fails, the original processor remains fully liable to the controller for the sub-processor’s performance.² That flow-through liability is why processors need to vet their own vendors as carefully as controllers vet processors.

Audits and Verification

The processor has to make available all information the controller needs to demonstrate compliance with Article 28, and it must allow and contribute to audits and inspections conducted by the controller or an auditor the controller designates.² The processor also has to speak up: if a controller’s instruction appears to violate data protection law, the processor must immediately inform the controller rather than silently comply.

Many processors satisfy the audit right by providing SOC 2 reports, ISO 27001 certifications, or other third-party assessments instead of hosting individual on-site audits from every customer. Whether that approach fits a particular controller’s rights depends on the contract wording and how the supervisory authority reads the audit obligation.

The Processor’s Own Records

Under Article 30(2), the processor has an independent record-keeping duty, separate from anything the controller maintains. The processor must keep a written record (electronic counts) of all processing carried out on behalf of each controller, covering:⁷

Names and contact details of the processor, each controller served, and any data protection officer
The categories of processing performed for each controller
Any transfers of personal data outside the EU, the destination country, and the safeguards in place
A general description of the technical and organizational security measures

The record must be made available to the supervisory authority on request.⁷

International Transfers

Article 28 ties directly into the GDPR’s transfer rules. The DPA has to address transfers to countries outside the EU, and the processor can only make such transfers on the controller’s documented instructions.² For transfers to countries without an adequacy decision, most organizations rely on the European Commission’s standard contractual clauses. The current SCCs use a modular structure, and the controller-to-processor module is the one that maps onto an Article 28 arrangement. Because Article 28(6) allows the DPA itself to be built on the SCCs, a single document can satisfy both the Article 28 contract requirement and the Article 46 transfer safeguards.

US-based processors also have a path through the EU-US Data Privacy Framework, which offers an adequacy-based mechanism for certified organizations. Given ongoing uncertainty about the framework’s durability, organizations that rely on it should keep a fallback transfer mechanism, such as SCCs, ready to activate.

What Non-Compliance Costs

Regulatory Fines

Article 28 violations fall under the lower fine tier in Article 83(4): up to €10 million or 2% of total worldwide annual revenue from the preceding financial year, whichever is higher.¹ That tier covers obligations under Articles 25 through 39, which sweeps in the full range of processor and security duties.

Civil Liability

Under Article 82, anyone who suffers material or non-material damage from a GDPR violation can sue the controller or processor directly. Controllers are liable for damage caused by non-compliant processing. Processors are liable when they’ve failed to meet obligations the GDPR aims specifically at them, or when they’ve acted outside or against the controller’s lawful instructions.⁸

Where both share responsibility for the same damage, they face joint and several liability. The affected individual can pursue the full amount from either one, and the paying party can then seek back the other’s proportionate share. A controller or processor escapes liability only by proving it bears no responsibility whatsoever for the event that caused the damage, which is a very difficult bar to clear.⁸

1
General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines
2
GDPR-Info. Art. 28 GDPR – Processor
3
GDPR-Info.eu. Art. 3 GDPR – Territorial Scope
4
General Data Protection Regulation (GDPR). Art. 26 GDPR – Joint Controllers
5
General Data Protection Regulation (GDPR). Art. 32 GDPR – Security of Processing
6
General Data Protection Regulation (GDPR). Art. 33 GDPR – Notification of a Personal Data Breach to the Supervisory Authority
7
GDPR-Info.eu. Art. 30 GDPR – Records of Processing Activities
8
General Data Protection Regulation (GDPR). Art. 82 GDPR – Right to Compensation and Liability