All 99 Articles Chapter 4: Controller and Processor
Whenever a processor handles data on your behalf, a written contract with specific mandatory terms (a Data Processing Agreement) must be in place. Processors have direct obligations too.
Key points
- Use only processors giving sufficient guarantees.
- A contract must set out subject-matter, duration, instructions, confidentiality, security and sub-processing.
Related articles
Practical guidance
These summaries are a plain-English orientation only and are not a substitute for the official text of the Regulation or for legal advice.
Need to apply Article 28?
Our data-protection lawyers turn the text into a plan.