Data processing with suppliers: what does Art. 28 GDPR require in practice?

A processor is anyone who processes personal data on behalf of and on the instructions of a controller (Art. 4(8) GDPR). Typical cases are hosting and data centre services, software as a service, IT maintenance with access to data, or sending letters and emails on someone's behalf.

There is no processing on behalf where a service provider has no access to personal data at all or decides itself on the purposes and means of the processing.

Under Art. 28(3) GDPR, the contract sets out the subject matter and duration, the nature and purpose of the processing, the type of personal data, the categories of data subjects and the obligations and rights of the controller. In particular, the processor undertakes to process data only on documented instructions (point a), to ensure confidentiality (point b), to take the measures required under Art. 32 (point c), to respect the rules on sub-processors (point d), to assist with data subject rights (point e) and with the obligations under Art. 32 to 36 (point f), to delete or return the data at the end of the service (point g) and to make available all necessary information and allow for audits (point h).

The contract must be in writing, which includes electronic form (Art. 28(9)). The standard contractual clauses of the European Commission can serve as a basis (Implementing Decision (EU) 2021/915).

Before the contract, the customer must check whether the supplier provides sufficient guarantees (Art. 28(1)). These include documented technical and organisational measures under Art. 32 – for example access protection, encryption, backups and procedures for regular testing.

Adherence to approved codes of conduct or certifications under the GDPR can be used as an element to demonstrate sufficient guarantees (Art. 28(5)). They do not replace the check itself.

The supplier may only engage further processors with prior specific or general written authorisation (Art. 28(2)). With a general authorisation, it informs the customer of every intended change, and the customer can object.

The sub-processor must be bound by the same data protection obligations; if it fails to fulfil them, the supplier remains liable to the customer (Art. 28(4)).

Often the contract is missing altogether, or it was signed once and never looked at again. Equally common are outdated lists of sub-processors, technical and organisational measures as generic boilerplate unrelated to the service, and no arrangement for deletion at the end of the contract.

Under Art. 83(4) GDPR, breaches of the obligations under Art. 28 can be fined up to €10 million or up to 2% of worldwide annual turnover, whichever is higher.

The Vendo4u catalog asks for the points that matter in a review under Art. 28 – whether a data processing agreement is available, where the data is processed, which sub-processors are used – and suppliers upload the related documents. Buyers see this information for all suppliers in the same structure and file it with the export in their own records.