Build processor due diligence around Article 28: role classification, required contract clauses, sub-processor approval, audit rights, return or deletion, and evidence that the vendor can meet the controller's instructions.
Use SCC transfer clauses only when the processing chain includes a Chapter V transfer, and keep that transfer record tied to the same vendor and sub-processor inventory.
Structured answer sets in this page tree.
Cited legal and guidance references.
Article 28 vendor management is not a procurement checklist with privacy language attached. For each service that processes personal data on behalf of a controller, the record should show why the supplier is a or sub-processor, which processing instructions apply, which Article 28 clauses govern the work, what evidence demonstrates sufficient guarantees, and whether any onward transfer needs Chapter V safeguards.
Start with the processing activity, not the supplier name. A service provider is a only for processing it performs on behalf of the controller and under the controller's documented instructions. If the supplier determines its own purposes and essential means for a separate activity, treat that activity as controller-to-controller or joint-controller analysis instead of forcing it into an Article 28 processor contract.
The contract label is evidence, but it is not enough. The role record should identify the processing purpose, the data categories, the data-subject categories, who decides the purpose, who sets the essential means, and which decisions are left to the vendor as non-essential implementation choices.
A contract or other binding legal act must set out the subject matter and duration of the processing, nature and purpose, personal-data types, data-subject categories, and the controller's obligations and rights. Those details should be populated for the actual service, not copied as empty GDPR recital language.
The operational clauses should cover documented instructions, confidentiality for authorised personnel, Article 32 security measures, sub- conditions, assistance with data-subject rights, assistance with Articles 32 to 36 obligations, deletion or return at the end of services, and audit or inspection support.
Article 28 requires the controller to use only processors that provide sufficient guarantees to implement appropriate technical and organisational measures. Vendor evidence should therefore prove the can perform the instructed processing in a way that meets GDPR requirements and protects data-subject rights.
Evidence should be tied to the exact processing activity. A generic security certificate, standard policy, or marketing claim can support the record, but it should not replace evidence of the service configuration, obligations, sub-processor chain, audit pathway, and incident cooperation that apply to the controller's data. Reassess the processor's guarantees when the service, instructions, sub-processor chain, transfer route, security measures, or audit findings change.
A may not engage another processor without the controller's prior specific or general written authorisation. If general authorisation is used, the processor must inform the controller of intended additions or replacements so the controller can object before the change takes effect.
Sub- management should be an active inventory, not a one-time list at signature. The record should show each sub-processor's processing activity, location or transfer relevance, approval status, notice date, objection window, contract flow-down, and whether the initial processor remains accountable for the sub-processor's performance.
A contract is not automatically an international-transfer mechanism. If the processor or a sub-processor transfers personal data to a third country or international organisation, the controller should connect the Article 28 instructions to the Chapter V transfer tool used for that transfer.
Where the 2021 transfer SCCs are used, keep the selected module, parties, data categories, transfer description, onward-transfer controls, and supplementary safeguards with the vendor record. Those SCCs may also satisfy Article 28(3) and (4) for covered controller-to- or processor-to-processor transfers when their conditions are met. The separate 2021/915 controller-processor clauses satisfy Article 28 but are not a Chapter V transfer tool. Either set of clauses can sit inside a wider agreement, but added terms must not contradict the clauses or prejudice data-subject rights.
No. Article 28 applies when a separate vendor processes personal data on behalf of the controller. If the vendor determines its own purposes and essential means for a separate processing activity, the team should assess controller or joint-controller roles instead of using terms as a shortcut.
Keep the signed Article 28 terms, completed processing description, documented instructions, security-measure evidence, confidentiality and access evidence, sub- approvals, audit or review evidence, assistance commitments, breach-support process, and return-or-deletion record.
SCCs belong in the vendor file when the vendor or an approved sub- creates a Chapter V transfer and SCCs are the selected transfer safeguard. The SCC record should identify the transfer route, parties, module, data categories, onward-transfer limits, and any supplementary safeguards.
Sorena can help convert vendor questionnaires, processor terms, SCCs, and sub-processor notices into a cited Article 28 evidence record for privacy, legal, security, and procurement teams.
Ask questions tied to cited sources about Article 28 clauses, controller-processor roles, sub-processors, vendor evidence, and SCC transfer records using the cited sources on this page.
Review your processor contract inventory, vendor evidence gaps, and international-transfer clauses with Sorena.
"modular approach"
"Standard Contractual Clauses"
"transfers of personal data"