Under GDPR Art. 28, what must a controller-processor contract contain, and what does it commit the processor to?

## Why the GDPR requires a contract at all A **processor** handles personal data on behalf of a **controller** (`Art. 4(8)`). Because the controller stays accountable for processing it has handed off, `Art. 28(1)` allows it to use only processors *providing sufficient guarantees* of appropriate technical and organisational measures, and `Art. 28(3)` requires the relationship to be governed by a **contract or other legal act** under Union or Member State law that is **binding on the processor** with regard to the controller. `Art. 28(9)` requires it to be **in writing, including in electronic form**, so a click-through data processing agreement can qualify. ## What the contract must describe Before the stipulations, `Art. 28(3)` requires the contract to *set out*: - the **subject-matter and duration** of the processing; - the **nature and purpose** of the processing; - the **type of personal data** and the **categories of data subjects**; - the **obligations and rights of the controller**. A generic agreement that never says what is processed, for whom and why does not meet this. ## The eight stipulations, points (a) to (h) | Point | The processor must... | |---|---| | (a) | process only on **documented instructions** from the controller, including on transfers to a third country, unless Union or Member State law requires otherwise, and then inform the controller first unless that law forbids it | | (b) | ensure that people authorised to process the data are bound by **confidentiality** | | (c) | take all measures required under **`Art. 32`** (security of processing) | | (d) | respect the conditions in `Art. 28(2)` and `(4)` for engaging **another processor** | | (e) | **assist** the controller, as far as possible, in responding to **data-subject rights** requests under Chapter III | | (f) | **assist** the controller with its obligations under **`Arts. 32 to 36`**: security, breach notification and communication, impact assessments and prior consultation | | (g) | at the controller's choice, **delete or return** all personal data at the end of the services and delete existing copies, unless law requires storage | | (h) | make available all **information** needed to demonstrate compliance, and allow for and contribute to **audits**, including inspections, by the controller or its mandated auditor | The article adds one more duty directly after the list: the processor must **immediately inform** the controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. ## Sub-processors Sub-processing has its own rules: 1. **Authorisation.** A processor may not engage another processor without the controller's **prior specific or general written authorisation** (`Art. 28(2)`). 2. **Notice and objection.** Under a *general* authorisation, the processor must **inform the controller of any intended addition or replacement**, giving it the opportunity to **object** (`Art. 28(2)`). 3. **Flow-down.** The same data protection obligations must be imposed on the sub-processor by contract or other legal act (`Art. 28(4)`). 4. **Liability.** If the sub-processor fails, the **initial processor remains fully liable to the controller** for its performance (`Art. 28(4)`). ## Standard clauses and guarantees The contract need not be drafted from scratch: - `Art. 28(6)` lets it be based wholly or partly on **standard contractual clauses** adopted by the Commission (`Art. 28(7)`) or by a supervisory authority (`Art. 28(8)`). The Commission adopted such clauses in Implementing Decision (EU) 2021/915. - Where a controller transfers data to a processor outside the GDPR's territorial scope, the Commission's transfer clauses in Decision (EU) 2021/914 state that they also fulfil the `Art. 28(3)` and `(4)` requirements for that relationship; the transfer rules themselves are a separate subject. - Adherence to an approved **code of conduct** (`Art. 40`) or **certification** (`Art. 42`) may be used as an element to demonstrate sufficient guarantees (`Art. 28(5)`), not as a substitute for the contract. ## What the contract does not do - It does **not** make the processor a controller or give it any purpose of its own. `Art. 29` repeats that the processor processes only on the controller's instructions. - It does **not** replace the processor's direct statutory duties, such as records of processing (`Art. 30(2)`), `Art. 32` security and notifying the controller of a breach without undue delay (`Art. 33(2)`). - It does **not** protect a processor that goes beyond it: one that determines purposes and means is treated as a controller for that processing (`Art. 28(10)`).