Article 28
CIPP/E glossary · Last reviewed: · By Victor Humenhuk (CIPP/E certified)
Article 28 - Requires a written controller-processor contract with mandatory content and governs sub-processing.
In the CIPP/E body of knowledge, Article 28 comes up under Ch 4.4.9-4.4.10 - Processor and processing contracts.
Article 28 in context
- [[Article 28]] requires a ==written contract== with mandatory terms: process ==only on documented instructions==, confidentiality, Article 32 security, sub-processor conditions, assist with data subject rights and Articles 32-36, ==delete or return== data at the end, and allow ==audits==. (The Processor and the Article 28 Contract)
- [[Article 32(4)]] covers employees and other workers acting under the controller's or processor's authority - read with Article 5(1)(f) and Article 28(3)(b), it creates what is effectively a [[duty of confidence]]. (Employees, the insider threat, and the controller-processor relationship)
- The GDPR advances it through the ==accountability== principle ([[Article 5(2)]]), mandatory [[data protection officer|DPOs]] ([[Articles 37-39]]), [[codes of conduct]] and [[certification]] schemes ([[Articles 40-43]]), and controller-over-processor regulation ([[Article 28]]). (Self-regulation: accountability, DPOs, codes and certification)
Where Article 28 is covered in the CIPP/E study notes
Related terms
- Article 29
- sub-processor
Test yourself on Article 28
Recognising a definition is not the same as applying it in an exam scenario. Work through the free CIPP/E practice questions, or read the full CIPP/E study guide - every study note is free.