- Article 28 of the GDPR governs work a processor does for a controller.
- Article 28(3) lists eight points the contract between them must stipulate.
- The Commission adopted standard clauses in Implementing Decision (EU) 2021/915.
A new customer is ready to sign. Then their procurement team sends one more document: a data processing agreement, often a dozen pages long, with a request to return it signed. The commercial terms are settled. This one is about the personal data your product will handle on the customer’s behalf, and what you commit to doing with it.
Most of what that document asks for comes from one article: Article 28 of Regulation (EU) 2016/679, the General Data Protection Regulation. Its heading is “Processor”. This guide sets out what the article says, in plain terms, with the source linked next to each legal fact.
It is not legal advice, and it is not a template. Whether a given agreement is right for your product, and whether you can keep every promise in it, is a judgement for you and your advisers. For the wider question of building privacy into a product, Data protection by design, for product leaders covers Article 25.
Who is who
The agreement sits between two roles the Regulation defines. The controller decides why and how personal data is processed (Article 4(7)). The processor processes personal data on the controller’s behalf (Article 4(8)).
When a business runs your product for its own staff or its own customers, it is usually the controller, and you are usually the processor. That is why the agreement arrives from them. The roles turn on the facts of each arrangement, and settling them for yours is a question for your advisers.
Article 28(1) explains why the customer cares. A controller may use “only processors providing sufficient guarantees” to implement appropriate technical and organisational measures, so that the processing meets the Regulation and protects the rights of the people whose data it is. The agreement is part of how a customer satisfies itself of that.
What the contract must say
Article 28(3) says processing by a processor is governed by “a contract or other legal act” that binds the processor. It sets out the subject-matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects, and the obligations and rights of the controller. Article 28(9) adds that it is in writing, “including in electronic form”.
The contract then stipulates, in particular, that the processor does eight things. In the article’s own order:
- (a) Processes the personal data “only on documented instructions from the controller”, including on transfers to a third country or an international organisation, unless Union or Member State law requires otherwise.
- (b) Ensures that the people authorised to process the data “have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality”.
- (c) “Takes all measures required pursuant to Article 32”, the article on security of processing.
- (d) Respects the conditions in paragraphs 2 and 4 for engaging another processor.
- (e) Assists the controller, as far as possible, in responding to requests from people exercising their rights under Chapter III.
- (f) Assists the controller with the obligations in Articles 32 to 36, taking into account the nature of processing and the information available to the processor.
- (g) “At the choice of the controller, deletes or returns all the personal data” at the end of the services, and deletes existing copies unless the law requires storage.
- (h) Makes available all information needed to demonstrate compliance with the article, and allows for and contributes to audits, “including inspections”.
The same paragraph adds that the processor tells the controller immediately if, in its opinion, an instruction infringes the Regulation or other data protection provisions.
Point (e) is the one product teams meet first. When one of your customer’s users asks for their data to be erased, the customer may turn to you to carry it out. The right to erasure, for product leaders covers that request.
Sub-processors
Most products pass some data on: hosting, email delivery, support tools. The Regulation calls each of those another processor, and the agreement usually calls them sub-processors.
Article 28(2) says a processor does not engage another processor “without prior specific or general written authorisation of the controller”. Under a general authorisation, the processor informs the controller of any intended addition or replacement, which gives the controller the opportunity to object.
Article 28(4) says the same data protection obligations as in the main contract are imposed on that other processor, by contract or other legal act. If the other processor fails to fulfil them, the initial processor “shall remain fully liable to the controller” for its performance.
The standard clauses
A contract does not have to be drafted from nothing. Article 28(7) lets the Commission lay down standard contractual clauses for the matters in paragraphs 3 and 4, and Article 28(6) says a contract may be based on them in whole or in part.
The Commission did so in Implementing Decision (EU) 2021/915 of 4 June 2021, on standard contractual clauses between controllers and processors. If the agreement on your desk says it follows those clauses, the decision is the text to compare it against. Whether clauses fit your arrangement, and which options to choose in them, is again for your advisers.
Questions to answer before it lands
None of this needs a lawyer in your planning meeting. It needs a few questions answered once, so the next agreement is a review rather than a scramble.
What personal data does the product handle for customers? Article 28(3) asks the contract to describe the type of data and the categories of people. A plain list, kept current, is the answer.
Who else touches it? Name every outside service that receives customer data. That list is your sub-processor list, and Article 28(2) is why customers will ask to see it and be told when it changes.
Can the product delete or return a customer’s data at the end? Point (g) leaves the choice to the controller. A product that can do either for one customer, cleanly, makes that clause an easy one to sign.
Who helps when a customer’s user makes a request? Point (e) asks for assistance. Name the person or role who receives that request from the customer and sees it through.
Who signs, and who checks we can keep it? Every point in the agreement is a promise about the product. The person who signs should know which team keeps each one.
Answer those, and you can lift your eyes from the clause numbers back to the customer who is waiting to start.
Where we come in
We do not advise on the GDPR, draft or review agreements, or promise that any product meets Article 28. That judgement stays with you and your advisers.
If your answers show work your product needs, such as a clean way to delete or return one customer’s data, that is the kind of change described in Harden security before the questionnaire arrives. The work lands in your own code repository. The code we build for you is yours. You decide what ships. Nothing reaches your users without your approval.
It starts with a conversation, with no obligation.
