# GDPR Article 28 — Processor - Source: https://support.icompaas.com/compliance/gdpr/article-28-processor - Section: [Compliance](https://support.icompaas.com/compliance) › [GDPR (Regulation (EU) 2016/679)](https://support.icompaas.com/compliance/gdpr) › Articles 21–30 - Last updated: 2026-06-05 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **GDPR**·Article `Article 28`·high·Component: **Chapter IV: Controller and Processor** ## What this control requires > Controllers must use processors with GDPR-compliant measures to protect data subjects' rights, governed by a binding contract. Processors require authorization for sub-processors, ensure confidentiality, assist with compliance, and allow audits. This control addresses Processor Management. > > — GDPR, Article Article 28 ### In plain English Controllers must use processors with GDPR-compliant measures to protect data subjects' rights, governed by a binding contract. In practice, this means you can prove you data controller-level controls on a defined cadence. ## Why it matters GDPR administrative fines reach the greater of €20 million or 4% of global annual turnover. The European Data Protection Board (EDPB) coordinates supervisory-authority enforcement across the EU/EEA, and DPAs publish enforcement decisions citing specific Articles. This control is rated **high**. Auditors expect a named owner, a remediation SLA, and a tooling artefact that evidences continuous operation. ## What an auditor looks for A DPA or privacy auditor expects: a Records of Processing Activities (RoPA) entry, a documented lawful basis, evidence the Article's data-subject right is operationalised end-to-end, a named DPO contact (where required), and Article 30 records that match what the front-end actually does. Within **Chapter IV: Controller and Processor**, the assessor will trace your implementation back to the catalogue reference (Article Article 28) and look for objective evidence on the latest two assessment cycles. ## How to implement #### Policy Management **Docs.** Keep each policy in version-controlled Markdown alongside the code that implements it; ship a signed PDF snapshot at each annual review and link the SHA into the SoA. ### Operational checklist - **Data.** Document the trigger, the owner and the cadence. - **Processor.** Document the trigger, the owner and the cadence. - **Security.** Document the trigger, the owner and the cadence. - **Confidentiality.** Document the trigger, the owner and the cadence. - **Scope:** controller, controllers, rights, data subjects. ## Evidence to collect - **Vendor Risk Management.** `vendor_risk_management` evidence - **Policy Document.** A signed and version-controlled policy / standard / procedure document. Third-party risk management evidence (assessments, contracts, due diligence) shows supplier oversight. Signed policy or standard documents the safeguard. Focus: Processor. ## Common pitfalls - Policies that no engineer has read; the version in Confluence drifts from the version that's actually being enforced. ## How it maps to other frameworks Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit. - [**ISO/IEC 27001:2022 A.5.19** — Information security in supplier relationships](https://support.icompaas.com/compliance/iso-27001-2022/a-5-19-information-security-in-supplier-relationships) - [**CIS Controls v8 3.8** — Document Data Flows](https://support.icompaas.com/compliance/cis-controls-v8/3-8-document-data-flows) - [**ISO/IEC 42001:2023 A.10.2** — Allocation of responsibilities](https://support.icompaas.com/compliance/iso-42001-2023/a-10-2-allocation-of-responsibilities) - [**BSI C5:2020 SSO-01** — Policies and instructions for controlling and monitoring third parties](https://support.icompaas.com/compliance/bsi-c5-2020/sso-01-policies-and-instructions-for-controlling-and-monitoring-third-parties) - [**NIST SP 800-171 Rev. 3 3.11.1** — Risk Assessment](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-11-1-risk-assessment) ## Related controls in GDPR - [**Article Article 27** — Representatives of controllers or processors not established in the Union](https://support.icompaas.com/compliance/gdpr/article-27-representatives-of-controllers-or-processors-not-established-in-the-union) - [**Article Article 33** — Notification of a personal data breach to the supervisory authority](https://support.icompaas.com/compliance/gdpr/article-33-notification-of-a-personal-data-breach-to-the-supervisory-authority) - [**Article Article 34** — Communication of a personal data breach to the data subject](https://support.icompaas.com/compliance/gdpr/article-34-communication-of-a-personal-data-breach-to-the-data-subject) - [**Article Article 79** — Right to an effective judicial remedy against a controller or processor](https://support.icompaas.com/compliance/gdpr/article-79-right-to-an-effective-judicial-remedy-against-a-controller-or-processor) - [**Article Article 25** — Data protection by design and by default](https://support.icompaas.com/compliance/gdpr/article-25-data-protection-by-design-and-by-default) - [**Article Article 21** — Right to object](https://support.icompaas.com/compliance/gdpr/article-21-right-to-object) ## References - [European Union — GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) - Catalogue identifier: `Article Article 28` Topics: governance riskvendor riskvendor managementsupply chain securitypolicy managementthird party monitoring ## Related compliance guidance - [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): Start with the full GDPR implementation guide — scope, roadmap, evidence and how the assessment runs. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): The security management system most EU procurement teams ask for alongside a DPA; its controls supply much of the Article 32 evidence. - [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If engineering or support teams sit in India, the same data flows are also subject to India’s Digital Personal Data Protection Act.