Government and public statistics
Article 28 GDPR: Processor
gdpr-info.eu (text of Regulation (EU) 2016/679), 2016
Read the originalRead on October 17, 2026
- What it is
- The text of Article 28 of the EU General Data Protection Regulation, which sets the rules for a processor that handles personal data for a controller, including the contract terms and rules on sub-processors.
- How much weight it carries
- The regulation's text, reproduced on a reference site. The Official Journal of the EU is the authoritative version, and the English text here should be checked against it for legal purposes.
Facts taken from this source
- Under Article 28(1) of the GDPR, processing by a processor must be governed by a contract or other legal act that binds the processor to the controller.
“Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller” (Article 28(1))
- Under GDPR Article 28(2), a processor cannot engage another processor without the controller's prior written authorization, either specific or general.
“The processor shall not engage another processor without prior specific or general written authorisation of the controller.” (Article 28(2))