GDPR Article 28 processor contract checklist for vendor reviews

A GDPR Article 28 contract must bind the processor and state the subject matter, duration, nature, purpose, data types and data subject categories, then include eight listed duties from instructions to audits. Use the checklist below to compare a vendor's data processing terms against the article. This is not legal advice.

When it applies

Article 28 applies when a vendor processes personal data on your behalf as a processor. If you are the controller, you need a contract or other legal act with that content. Have counsel confirm the roles for each vendor.

Part 1: What the contract must set out

Check that the document states:

• Subject matter and duration of the processing.
• Nature and purpose of the processing.
• Types of personal data.
• Categories of data subjects.
• The controller's obligations and rights.

Vague text such as "customer data" is weak. Ask for specifics.

Part 2: The eight processor duties

According to the text of Article 28(3), the contract must stipulate that the processor:

1. (a) Processes personal data only on documented instructions from the controller, including for transfers to third countries, unless law requires otherwise.
2. (b) Ensures authorised personnel are bound by confidentiality.
3. (c) Takes the security measures required under Article 32.
4. (d) Respects the conditions for engaging another processor.
5. (e) Helps the controller respond to data subject rights requests.
6. (f) Helps the controller meet obligations under Articles 32 to 36, which include security, breach notification and impact assessments.
7. (g) At your choice, deletes or returns all personal data after the services end, and deletes copies unless law requires storage.
8. (h) Provides information needed to show compliance and allows and contributes to audits, including inspections. It must also tell you immediately if it thinks an instruction infringes data protection law.

Part 3: Sub-processors

Paragraphs 2 and 4 add that the processor needs your prior written authorisation, specific or general, before engaging another processor. With general authorisation, it must inform you of changes and let you object. It must flow the same obligations down by contract and remains fully liable to you for the sub-processor.

Part 4: Practical checks

• Does the vendor's template mention each of (a) to (h)? Mark the clause number next to each.
• Is the deletion or return window stated in days?
• Is the audit right usable? See right to audit clauses.
• Does the contract give a way to learn of a breach quickly? See vendor breach notification terms.
• Are subprocessors listed or linked, with a change notice method?

Keep the evidence

File the signed contract, the subprocessor list as of signing, and your notes. If a regulator or customer asks how you oversee processors, that file is your answer.

Quick check

Sources

• GDPR Article 28

Last reviewed: 19 October 2026.