Skip to content
cyberGDPR

07 · Art. 28 · Area

Processors & contracts

Every SaaS tool, cloud provider and MSP that touches personal data on your behalf is a processor. Art. 28 decides what the contract must say, and the security team is usually the one asked whether the vendor offers sufficient guarantees. This area covers roles, mandatory clauses, sub-processors and due diligence.

  1. GDPR Article 28: Processor Contracts and Vendor Vetting

    A security team's guide to GDPR Article 28: controller vs processor roles, the mandatory DPA clauses, sub-processors and a SaaS vendor due diligence checklist.