# GDPR Article 28: Processor

- Source: https://support.icompaas.com/support/solutions/articles/62000236373-gdpr-article-28-processor
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GDPR](https://support.icompaas.com/support/solutions/62000112722) › [Chapter IV: Controller and Processor](https://support.icompaas.com/support/solutions/folders/gdpr-chapter-4-controller-and-processor)
- Last updated: 2026-07-11
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Overview**

This article ensures that controllers use processors who implement GDPR-compliant measures to protect the rights of data subjects. Processing activities must be governed by a binding contract that outlines responsibilities and ensures compliance with GDPR obligations.

  

### **Key Principles**

-   Contractual Governance: Controllers must establish binding contracts with processors.
    
-   Sub-Processor Authorization: Processors require prior authorization to engage sub-processors.
    
-   Confidentiality and Security: Processors must maintain confidentiality and implement technical and organizational measures to protect personal data.
    
-   Compliance Assistance and Audits: Processors must assist controllers in fulfilling GDPR obligations and allow audits or inspections.  
      
    

### **Organizational Applicability**

This article applies to all organizations processing personal data within the EU:

-   Controllers engaging processors to perform data processing activities.
    
-   Public and private sector entities managing third-party processing relationships.
    
-   Teams responsible for vendor management, legal compliance, and data governance.  
      
    

### **Implementation Requirements**

-   Ensure processors are GDPR-compliant before engagement.
    
-   Establish a written contract specifying processing purposes, obligations, and security measures.
    
-   Require processors to obtain authorization for any sub-processors.
    
-   Include provisions for audit, assistance with compliance, and confidentiality.  
      
    

### **Implementation Guidance**

-   Maintain a vendor management process to assess processor compliance.
    
-   Use standard contractual clauses to formalize GDPR obligations.
    
-   Periodically review processor contracts and compliance performance.
    
-   Train staff on managing processor relationships and ensuring GDPR obligations are met.  
      
    

### **Periodic Review**

-   Frequency: Annually or when engaging new processors or updating contracts.
    
-   Responsible Role: Data Protection Officer (DPO), Compliance Team, or Legal.
    
-   Outcome: Ensure all processors operate under GDPR-compliant contracts and safeguard personal data.  
      
    

### **Non-Compliance Risks**

-   Fines: Up to €20 million or 4% of global annual turnover.
    
-   Legal Exposure: Liability for processor non-compliance and enforcement actions.
    
-   Reputational Damage: Loss of trust due to poor processor management.
    
-   Operational Risk: Data breaches or failures in compliance due to inadequately managed processors.

## Related compliance guidance

- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): How the Regulation fits together as a programme — lawful bases, Article 28/30/32/33 obligations, transfers and the DPIA process.
- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If you also serve users in India, the DPDP Act borrows GDPR concepts but differs on consent, breach reporting and transfers.