Most processor agreements miss at least one of the eight clauses Article 28(3) makes mandatory. Below you can download a clause-by-clause checklist and score your DPA against each requirement.
Download the checklistWhen your company hands personal data to a vendor — a cloud host, an analytics SaaS, a payroll bureau, an AI provider — that vendor becomes a processor and you remain the controller. Article 28 GDPR makes the relationship conditional on a written contract that carries eight specific undertakings.
The problem is rarely the absence of a contract. It is a contract that exists but is incomplete: a data processing agreement (DPA) that omits audit rights, leaves sub-processing open, or disposes of deletion in one vague line. In an enforcement review the regulator reads the DPA clause by clause against Art. 28(3), and a missing clause is a finding regardless of how the processing actually ran.
Art. 28(1): engage only processors giving sufficient guarantees. Art. 28(2) and (4): no sub-processor without authorisation, and the same obligations must flow down by contract. Art. 28(3): the contract must bind the processor on eight points, (a) to (h). Art. 28(9): it must be in writing, including electronic form.
| Provision | Requirement | What to check in your DPA |
|---|---|---|
| Art. 28(3)(a) | Documented instructions | Processing only on the controller’s documented instructions, transfers included |
| Art. 28(3)(b) | Confidentiality | Authorised persons bound by confidentiality (contract or statute) |
| Art. 28(3)(c) | Security | All Article 32 measures undertaken |
| Art. 28(3)(d) | Sub-processors | 28(2)/(4) conditions respected; same obligations flow down |
| Art. 28(3)(e) | Data subject rights | Processor assists with Chapter III requests |
| Art. 28(3)(f) | Security, breach, DPIA | Assistance with Articles 32-36, given available information |
| Art. 28(3)(g) | Return or deletion | Delete or return at the controller’s choice; copies deleted |
| Art. 28(3)(h) | Audits | Information to demonstrate compliance; audits and inspections allowed |
| Art. 28(3) final | Unlawful instruction | Processor informs controller if an instruction infringes the law |
Article references reflect Regulation (EU) 2016/679 as at the date this page was prepared. Confirm against the version in force.
Score your data processing agreement against each Article 28 requirement. Copy the text or download it as markdown. No sign-up.
# DATA PROCESSING AGREEMENT — ARTICLE 28 ASSESSMENT CHECKLIST
Document code: DPA-28-CHK-01 · Version 1.0 · Classification: Internal
Controller: ...................... Processor: ......................
Agreement date: ....../....../20.... Reviewer: ......................
SCORING: [Y] present and adequate [P] partial / needs wording [N] missing
PART A — RELATIONSHIP AND SCOPE
[ ] A1 The parties and their roles (controller / processor) are identified.
[ ] A2 Subject matter, duration, nature and purpose of processing are set out.
[ ] A3 Types of personal data and categories of data subjects are listed.
[ ] A4 The agreement is in writing, including electronic form (Art. 28(9)).
PART B — THE EIGHT MANDATORY CLAUSES (Art. 28(3))
[ ] B1 (a) Processing only on the controller's documented instructions,
including for transfers to a third country.
[ ] B2 (b) Persons authorised to process are under a duty of confidentiality.
[ ] B3 (c) All Article 32 security measures are undertaken.
[ ] B4 (d) Sub-processors: no engagement without authorisation (general or
specific); the same data-protection obligations flow down by contract;
the processor stays fully liable for its sub-processors.
[ ] B5 (e) The processor assists the controller in responding to data subject
requests (Chapter III).
[ ] B6 (f) The processor assists with Articles 32-36 (security, breach
notification, DPIA, prior consultation), given the information available.
[ ] B7 (g) On termination, data is deleted or returned at the controller's
choice, and existing copies deleted unless retention is required by law.
[ ] B8 (h) The processor makes available all information needed to demonstrate
compliance and allows and contributes to audits and inspections.
[ ] B9 The processor must tell the controller if an instruction infringes the
GDPR or applicable data-protection law.
PART C — SUB-PROCESSORS (Art. 28(2) & (4))
[ ] C1 Authorisation model is stated (general with prior notice, or specific).
[ ] C2 A current sub-processor list / annex exists.
[ ] C3 Change-notification and objection mechanism is defined.
[ ] C4 Back-to-back data-protection obligations are imposed on each sub-processor.
PART D — INTERNATIONAL TRANSFERS (Art. 44 et seq.)
[ ] D1 Transfer locations (processor and sub-processors) are identified.
[ ] D2 A valid transfer tool is in place (adequacy / SCCs / BCRs).
[ ] D3 Standard Contractual Clauses, where used, are attached and completed.
[ ] D4 A transfer impact assessment exists where required.
PART E — SECURITY, BREACH, RECORDS
[ ] E1 Technical and organisational measures are described, not merely referenced.
[ ] E2 Breach notice to the controller is "without undue delay", with a timeline.
[ ] E3 The processor keeps records of processing on the controller's behalf (Art. 30(2)).
[ ] E4 Audit frequency, cost and method are workable, not merely nominal.
RESULT
Count of [N] / [P] items: .... Priority gaps: ..............................
Owner for remediation: .............. Target date: ....../....../20....
This checklist is general in nature and does not constitute legal advice.
A DPA can be signed, on letterhead, and still fail Article 28. The recurring gaps:
No. Signature proves a contract exists; compliance depends on whether all eight clauses in Art. 28(3)(a)-(h) are present and adequate, sub-processing is controlled, and deletion and audit rights are real. A signed but incomplete DPA is still a finding.
Sometimes a provider publishes a separate DPA that you accept, and that can qualify. Generic terms of service usually do not, because they lack the controller-specific instructions, sub-processor controls and audit rights Article 28 requires. Check whether a dedicated DPA document is incorporated.
Yes. SCCs are a transfer mechanism under Chapter V; the DPA is the Article 28 processor contract. They overlap but do not substitute for each other. Newer SCC modules carry Art. 28 terms, but you still confirm the full clause set applies to your relationship.
Both can be liable, but the controller carries the primary accountability obligation (Art. 5(2), 24). A deficient DPA weakens the controller’s position first, which is why the assessment is run from the controller’s side.
Turkish law (Law No. 6698) has the controller / "veri işleyen" distinction and requires written instructions and security, though it does not mirror the Art. 28(3) list clause-for-clause. For a combined view, use the KVKK + GDPR deficiency report.