{"answer_id":"praxikon:eu:gdpr:answer:verwerker","canonical_page":"https://www.praxikon.com/en/antwoord/avg/verwerker","query":"When is a supplier a processor, and what must be arranged in the contract?","lang":"en","view":"full","mode":"gdpr","regime":"gdpr","topic":"verwerker","question":"When is a supplier a processor, and what must be arranged in the contract?","label":"Processor and data processing agreement","answer":"A supplier that processes personal data only on behalf of and on the instructions of the customer is a processor (Article 4(8)). The processing must then be governed by a contract (Article 28(3)) that provides, among other things: processing only on documented instructions; confidentiality of the persons processing the data; security in accordance with Article 32; conditions for engaging sub-processors (Article 28(2) and (4)); assistance with data subjects' requests and with the obligations of Articles 32 to 36; deletion or return of the data at the end of the service; and information and cooperation for audits. If the supplier determines purposes or means itself, it becomes a controller for that part (Article 28(10)).","applied_to_question":null,"matched_terms":[],"articles":[{"article":4,"source_locator":"Art. 4(8) GDPR","point":"Definition of processor.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/4"},{"article":28,"source_locator":"Art. 28(3)(a) to (h) GDPR","point":"Mandatory content of the data processing agreement.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/28"},{"article":28,"source_locator":"Art. 28(10) GDPR","point":"Whoever determines purposes and means itself is a controller.","source_title":"GDPR (Regulation (EU) 2016/679)","source_url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","human_page":"https://www.praxikon.com/en/avg/artikel/28"}],"case_law":[],"guidance":[{"id":"edpb-gl-07-2020","kind":"guidance","title":"Guidelines 07/2020 on the concepts of controller and processor in the GDPR","issuer":"EDPB","reference":"v2.1","ecli":null,"date":"2021-07-07","status":"final","point":"Guidelines on the concepts of controller and processor.","source_url":"https://www.edpb.europa.eu/documents/guideline/guidelines-072020-on-the-concepts-of-controller-and-processor-in-the-gdpr_en","human_page":null},{"id":"com-2021-915-scc-processors","kind":"decision","title":"Standard contractual clauses between controllers and processors","issuer":"European Commission","reference":"(EU) 2021/915","ecli":null,"date":"2021-06-04","status":null,"point":"Standard contractual clauses between controllers and processors.","source_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021D0915","human_page":null},{"id":"edpb-op-22-2024","kind":"guidance","title":"Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)","issuer":"EDPB","reference":null,"ecli":null,"date":"2024-10-07","status":"final","point":"Obligations when relying on processors and sub-processors.","source_url":"https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-222024-on-certain-obligations-following-from-the_en","human_page":null}],"enforcement":[],"open_questions":["Does the supplier also use the data for its own purposes, such as improving its product?"],"human_page":"https://www.praxikon.com/en/avg/artikel/4","dataset":{"id":"praxikon-gdpr","source":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","known_at":"2026-09-15"},"casus_check":"https://www.praxikon.com/en/casus-check","disclaimer":"General interpretation, not legal advice. The official source remains authoritative.","methodology":"https://www.praxikon.com/en/methodologie"}