GDPR processor contract checklist: what Article 28 requires

A GDPR processing contract under Article 28 must be binding, in writing, and must state the subject matter, duration, nature, purpose, data types and categories of people, plus the controller's rights and obligations. It must also include eight processor commitments, listed below.

The contract must set out

• Subject matter and duration of the processing.
• Nature and purpose of the processing.
• Types of personal data and categories of data subjects.
• The obligations and rights of the controller.

The eight commitments

Check that the agreement requires the processor to:

1. Process personal data only on the controller's documented instructions, including for transfers to third countries, unless law requires otherwise, in which case it tells the controller first where permitted.
2. Make sure authorised personnel are under a confidentiality commitment or statutory duty.
3. Apply the security measures of Article 32.
4. Respect the conditions for using another processor.
5. Assist the controller with data subject rights requests, with appropriate measures where possible.
6. Assist with the controller's obligations under Articles 32 to 36 (security, breach notification, impact assessments, prior consultation).
7. At the controller's choice, delete or return all personal data when services end, and delete existing copies unless law requires storage.
8. Provide the information needed to demonstrate compliance and allow and contribute to audits, including inspections, by the controller or its auditor.

The processor must also tell the controller immediately if it thinks an instruction breaches data protection law.

Sub-processors

The processor needs the controller's prior written authorisation to engage another processor. That can be specific or general. With general authorisation the processor must tell the controller about intended additions or replacements and give the chance to object. The same obligations must be passed to the sub-processor by contract, and the first processor stays fully liable to the controller if the sub-processor fails.

Practical review steps

1. Ask for the vendor's current sub-processor list and a change notification address.
2. Check the breach notice period against your own 72 hour window.
3. Confirm where data is stored and where it can be accessed from.
4. Read the deletion clause and ask how long backups persist.
5. Agree how audits work in practice, for example report review first, then on site.
6. Keep a signed copy where the privacy team can find it.

Adherence to an approved code of conduct or certification can help show that a processor offers sufficient guarantees, but it does not replace the contract.

If you are the processor

Customers will send you their own paper. Prepare a standard agreement that already covers the points above, a public sub-processor page and a clear breach notice commitment. It shortens sales cycles and reduces redlines.

Quick check

Safeguard's compliance and evidence automation can store vendor documents and track review status alongside your other evidence. It does not draft the legal terms.

Sources

• GDPR Article 28, processor
• GDPR Article 33

Last reviewed: 19 October 2026.