Build due diligence around Article 28: role classification, required contract clauses, sub-processor approval, audit rights, return or deletion, and evidence that the vendor can meet the controller's instructions.
Use SCC transfer clauses only when the processing chain includes a Chapter V transfer, and keep that transfer record tied to the same vendor and sub- inventory.
For each service that processes personal data on behalf of a controller, the record should show why the supplier is a or sub-processor, which processing instructions apply, which Article 28 clauses govern the work, what evidence demonstrates sufficient guarantees, and whether any onward transfer needs Chapter V safeguards.
Start with the processing activity, not the supplier name. A service provider is a only for processing it performs on behalf of the controller and under the controller's documented instructions. If the supplier determines its own purposes and essential means for a separate activity, treat that activity as controller-to-controller or joint-controller analysis instead of forcing it into an Article 28 processor contract.
The contract label is evidence, but it is not enough. The role record should identify the processing purpose, the data categories, the data-subject categories, who decides the purpose, who sets the essential means, and which decisions are left to the vendor as non-essential implementation choices.
Sources (1)
Article 28 requires processors to act on documented instructions and treats a processor that determines purposes and means as a controller for that processing.
documented instructions
A contract or other binding legal act must set out the subject matter and duration of the processing, nature and purpose, personal-data types, data-subject categories, and the controller's obligations and rights. Those details should be populated for the actual service, not copied as empty GDPR recital language.
The operational clauses should cover documented instructions, confidentiality for authorised personnel, Article 32 security measures, sub- conditions, assistance with data-subject rights, assistance with Articles 32 to 36 obligations, deletion or return at the end of services, and audit or inspection support.
Sources (2)
Article 28(3) lists the required processor-contract content, including instructions, confidentiality, security, assistance, deletion or return, and audits.
contract or other legal act
The Commission controller-processor standard clauses provide a structured Article 28 clause set for instructions, purpose limitation, security, audits, sub-processors, international transfers, assistance, breach support, and termination.
standard contractual clauses between controllers and processors
Article 28 requires the controller to use only processors that provide sufficient guarantees to implement appropriate technical and organisational measures. Vendor evidence should therefore prove the can perform the instructed processing in a way that meets GDPR requirements and protects data-subject rights.
Evidence should be tied to the exact processing activity. A generic security certificate, standard policy, or marketing claim can support the record, but it should not replace evidence of the service configuration, obligations, sub-processor chain, audit pathway, and incident cooperation that apply to the controller's data. Reassess the processor's guarantees when the service, instructions, sub-processor chain, transfer route, security measures, or audit findings change.
Sources (2)
Article 28(1) requires sufficient guarantees, and Article 28(3)(h) requires information necessary to demonstrate compliance and allow or contribute to audits.
sufficient guarantees
The controller-processor standard clauses include documentation, audit, security-measure annex, assistance, and breach-support structures that can be reused as evidence fields.
Documentation and compliance
A may not engage another processor without the controller's prior specific or general written authorisation. If general authorisation is used, the processor must inform the controller of intended additions or replacements so the controller can object before the change takes effect.
Sub- management should be an active inventory, not a one-time list at signature. The record should show each sub-processor's processing activity, location or transfer relevance, approval status, notice date, objection window, contract flow-down, and confirmation that the initial processor remains fully liable to the controller for the sub-processor's obligations.
Sources (2)
Article 28(2) and 28(4) set the written authorisation, change-notice, objection, flow-down, and initial-processor-liability rules for sub-processors.
another processor
Clause 7.7 of the controller-processor standard clauses provides specific and general authorisation options and a sub-processor annex model.
Use of sub-processors
A contract is not automatically an international-transfer mechanism. If the processor or a sub-processor transfers personal data to a third country or international organisation, the controller should connect the Article 28 instructions to the Chapter V transfer tool used for that transfer.
Where the 2021 transfer SCCs are used, keep the selected module, parties, data categories, transfer description, onward-transfer controls, and supplementary safeguards with the vendor record. Those SCCs may also satisfy Article 28(3) and (4) for covered controller-to- or processor-to-processor transfers when their conditions are met. The separate 2021/915 controller-processor clauses satisfy Article 28 but are not a Chapter V transfer tool. Either set of clauses can sit inside a wider agreement, but added terms must not contradict the clauses or prejudice data-subject rights.
No. Article 28 applies when a separate vendor processes personal data on behalf of the controller. If the vendor determines its own purposes and essential means for a separate processing activity, the team should assess controller or joint-controller roles instead of using terms as a shortcut.
Keep the signed Article 28 terms, completed processing description, documented instructions, security-measure evidence, confidentiality and access evidence, sub- approvals, audit or review evidence, assistance commitments, breach-support process, and return-or-deletion record.
SCCs belong in the vendor file when the vendor or an approved sub- creates a Chapter V transfer and SCCs are the selected transfer safeguard. The SCC record should identify the transfer route, parties, module, data categories, onward-transfer limits, and any supplementary safeguards.
Sources (4)
The Commission transfer SCC decision explains that SCCs provide Article 46 safeguards for third-country transfers, use modules for different role combinations, and incorporate Article 28 terms in Modules 2 and 3.
modular approach
Adopts standard clauses for controller-processor relationships under Article 28 and states that those clauses are not SCCs for Chapter V transfers.
The Commission SCC page describes modernised SCCs for transfers from controllers or processors in the EU/EEA, or otherwise subject to the GDPR, to controllers or processors outside the EU/EEA and not subject to the GDPR.
Standard Contractual Clauses
Article 28(3)(a) requires documented instructions for transfers, and Chapter V governs transfers to third countries or international organisations.
transfers of personal data
Sorena can help convert vendor questionnaires, processor terms, SCCs, and sub-processor notices into a cited Article 28 evidence record for privacy, legal, security, and procurement teams.
Ask questions tied to cited sources about Article 28 clauses, controller-processor roles, sub-processors, vendor evidence, and SCC transfer records using the cited sources on this page.
Review your processor contract inventory, vendor evidence gaps, and international-transfer clauses with Sorena.
"Processing by a processor"
"documented instructions"
"contract or other legal act"
"sufficient guarantees"
"another processor"
"transfers of personal data"
"standard contractual clauses between controllers and processors"
"Documentation and compliance"
"Use of sub-processors"
"standard contractual clauses for the transfer"
"modular approach"
"data transfers from controllers or processors"
"Standard Contractual Clauses"
A concrete GDPR scope test for personal data, controller and processor roles, EU establishment, EU targeting or monitoring, special-category and child data, transfers, vendors, and evidence.
This GDPR Article 30 RoPA intake workflow helps capture controller and processor fields, owners, transfers, retention, security measures, and evidence before a processing activity goes live.
GDPR guide to profiling and Article 22 decisions: scope, transparency, lawful basis, DPIA triggers, safeguards, human intervention, challenge rights, and evidence.
EU GDPR breach notification workflow covering awareness, 72-hour supervisory authority notices, processor escalation, high-risk data-subject communication, delay reasons, and evidence logs.
A concrete EU GDPR breach notification workflow for detecting and triaging incidents, starting the awareness clock, assessing risk, notifying authorities or data subjects, and keeping Article 33 records.
This GDPR checklist helps review scope, lawful basis, notices, DSAR handling, DPIAs, RoPA, processor contracts, SCC transfers, breach notification, retention, security, and evidence.
GDPR guide to children's consent and special-category data: Article 8 national age variation, Article 9 conditions, transparency, DPIA triggers, safeguards, and evidence.
Practical EU GDPR compliance guide for mapping scope, lawful basis, notices, data-subject rights, DPIAs, RoPA, processor terms, breaches, transfers, retention, security, and penalties.
Classify GDPR controllers, processors, and joint controllers from actual decision-making, then document Article 26 allocation, Article 28 terms, instructions, and vendor evidence.
GDPR rights-request workflow for intake, identity checks, request scope, the one-month response clock, extensions, refusals, processor coordination, and evidence.
EU GDPR calendar for calculating rights-request deadlines, breach notification, DPIA and prior-consultation gates, transfer reviews, and retention checks.
Screen high-risk processing, run a GDPR Article 35 DPIA, record mitigation, and identify when Article 36 prior consultation is required.
EU GDPR DPIA guide covering Article 35 triggers and contents, CNIL and DPC PIA methods, residual risk, mitigation records, and prior consultation limits.
Run a GDPR DSAR workflow for intake, identity checks, rights scoping, one-month response timing, extensions, refusals, processor handoffs, and evidence records.
Direct EU GDPR FAQ answers on scope, controller and processor roles, lawful basis, data subject rights, DPIAs, breach notification, international transfers, and Article 83 fine tiers.
GDPR Chapter V guide to adequacy decisions, SCCs, transfer assessments, supplementary measures, Article 49 derogations, and EU-US DPF checks.
Focused GDPR guide to Article 6 lawful bases, consent conditions, legitimate interests, special category data, withdrawal, and evidence records.
Assess GDPR legitimate interests with a purpose, necessity, balancing, Article 21 objection, and evidence-record workflow based on Article 6(1)(f).
How GDPR main establishment, cross-border processing, Article 56 lead authority competence, and Article 60 cooperation fit together.
This EU GDPR legitimate interests assessment template helps document Article 6(1)(f) purpose, necessity, balancing, safeguards, objection rights, and evidence.
EU GDPR penalties guide covering Article 83 fine ceilings, the EDPB calculation method, CJEU conditions, Article 58 powers, and evidence.
Build a GDPR Article 30 record of processing activities with separate controller and processor fields for purposes, data categories, recipients, transfers, erasure time limits, and security measures.
Overview of core EU GDPR requirements covering scope, principles, lawful basis, notices, data-subject rights, processors, RoPA, security, breaches, DPIAs, and international transfers.
Build an EU GDPR retention and erasure schedule with purpose-based periods, expiry actions, Article 17 decisions, recipient notices, and deletion evidence.
A GDPR workflow for checking adequacy, selecting SCC modules, documenting transfer impact assessments, and recording supplementary measures for third-country transfers.
GDPR privacy-notice guide for Articles 12, 13, and 14: direct collection, other data sources, purposes, lawful bases, recipients, transfers, retention, rights, and timing.
Compare EU GDPR and Brazil LGPD scope, actors, legal bases, rights timing, security incidents, international transfers, evidence, regulators, and penalties.
Compare EU GDPR and California CCPA scope, roles, consumer rights, response times, sale and sharing opt-outs, risk assessments, contracts, transfers, and enforcement.
Compare the EU GDPR and ePrivacy Directive for personal data processing, consent and lawful basis, cookies and terminal access, electronic communications, and parallel compliance.
Compare the EU GDPR and amended UK GDPR across scope, rights, automated decisions, accountability, breaches, regulators, and international transfers.
Map the GDPR work that remains necessary when an AI system processes personal data, including lawful basis, notices, DPIAs, Article 22, rights, security, records, and transfers.
Compare GDPR privacy duties with EU Data Act rights and duties for connected-product data, third-party access, data holders, users, contracts, cloud switching, and enforcement.
A GDPR Article 3 territorial-scope FAQ covering EU establishment, non-EU targeting, monitoring in the EU, public-international-law cases, and Article 27 representatives.
FAQ on the six Article 6 GDPR lawful bases, consent caveats, legitimate interests, public-task and legal-obligation limits, and Article 9 special-category data.
FAQ on when EU GDPR controllers may extend, charge for, narrow, redact, or refuse a data subject access request under Articles 12 and 15.
FAQ on when SCC transfer impact assessments are needed, what Clause 14 records, and when supplementary safeguards or transfer suspension are required.
Decide whether a party is a GDPR controller, processor, or joint controller using purpose-and-means tests, Article 28 terms, Article 26 arrangements, and Article 30 records.
Answer the EU GDPR DPIA threshold question with Article 35 triggers, high-risk criteria, supervisory-authority list checks, and DPIA content requirements.
GDPR breach-awareness FAQ covering the Article 33 clock, processor escalation, delayed or phased notifications, risk assessment, and records to keep.