My cloud provider wants to decide for itself which other processors it engages. Is that allowed?

Only with your prior written authorisation (paragraph 2). That authorisation may be general, but then the processor must inform you of every addition or replacement and give you the chance to object. The other processor must be given the same obligations as in your contract, and the initial processor remains fully liable to you (paragraph 4).

What must a data processing agreement contain as a minimum?

Paragraph 3 first requires a description of the processing: subject matter, duration, nature and purpose, type of personal data, categories of data subjects and the obligations and rights of the controller. Then come the obligations in points (a) to (h), from processing on documented instructions to contributing to audits. The contract must be in writing, electronic form is allowed (paragraph 9), and it may be based in whole or in part on standard contractual clauses from the Commission or a supervisory authority (paragraphs 6 to 8).

What happens if a processor starts using the data for its own purposes?

It then determines the purposes and means of that processing itself and is treated as a controller for it (paragraph 10). It then carries all the obligations of a controller, on top of the liability and penalties dealt with in Articles 82, 83 and 84. For the controller, this is a reason to pin down the documented instructions of paragraph 3(a) precisely.

Article 28: Processor

Praxikon tracks Article 28 (Processor) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IVIn force since 25-05-2018

Article 28 sets out what must happen when an organisation has another party process personal data on its behalf, for example a payroll provider or a cloud service. The controller may only use processors that provide sufficient guarantees that they implement appropriate technical and organisational measures (paragraph 1). The arrangements must be laid down in a written contract with mandatory elements (paragraphs 3 and 9), and a processor may only engage another processor with the controller's authorisation (paragraphs 2 and 4). The article exists because the protection of the data subject must not disappear once data leaves the building: recital 81 explains that the processor must be bound to the controller and that the choice of a processor should rest on expert knowledge, reliability and resources. A processor that starts determining the purposes and means of processing itself is treated as a controller for that processing (paragraph 10).

Key term: Data processing agreement: the written contract that binds the processor to the controller and sets out what it may do with the personal data (paragraphs 3 and 9)

Directly affects:controllerprocessorCommissionsupervisory authority

Praxikon’s reading of the text and the recitals; the official text below prevails.

Official text

Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.

The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.

Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: (a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; (b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; (c) takes all measures required pursuant to Article 32; (d) respects the conditions referred to in paragraphs 2 and 4 for engaging another processor; (e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III; (f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor; (g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data; (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.

Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor's obligations.

Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as referred to in paragraphs 1 and 4 of this Article.

Without prejudice to an individual contract between the controller and the processor, the contract or the other legal act referred to in paragraphs 3 and 4 of this Article may be based, in whole or in part, on standard contractual clauses referred to in paragraphs 7 and 8 of this Article, including when they are part of a certification granted to the controller or processor pursuant to Articles 42 and 43.

The Commission may lay down standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the examination procedure referred to in Article 93(2).

A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the consistency mechanism referred to in Article 63.

The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form.

Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

Decision tree

Are you a controller, a processor or a joint controller?

Your role follows from what you actually do, not from what the contract says. Assess the role per processing operation: one organisation can be processor for one operation and controller for another.

Question 1 · Art. 4(1) en 2

Are personal data processed in this activity?

Full diagram

1
Are personal data processed in this activity?
Art. 4(1) en 2
- Yes → Question 2
- No → Outcome A
2
Do you, alone or jointly with others, determine the purpose of the processing and the essential means, such as which data, about whom and for how long?
Art. 4(7)
- Yes → Question 3
- No → Question 5
3
Do you determine purpose and means together with another organisation, through a common decision or through converging decisions so that the processing would not take place without both?
Art. 26(1)
- Yes → Outcome D
- No, we decide that alone → Question 4
4
Do you have another party process personal data on your behalf, such as a cloud or SaaS supplier or a payroll provider?
Art. 28(1)
- Yes → Outcome C
- No → Outcome B
5
Do you process the data on behalf of another organisation and according to its instructions?
Art. 4(8)
- Yes → Question 6
- No → Outcome H
6
Do you also use the data for your own purposes, such as improving or training your own product or AI model, or otherwise determine purpose and means yourself?
Art. 28(10)
- Yes → Outcome G
- No, only for the client → Question 7
7
Do you engage another processor yourself, such as a hosting provider or an AI service?
Art. 28(2) en 4
- Yes → Outcome F
- No → Outcome E

Outcome A · Does not apply

No GDPR role allocation needed

Without personal data the GDPR roles do not apply. If the data can be linked to a person, they are personal data after all.

Art. 4(1)

Outcome B · Applies

You are the controller

You carry responsibility for the whole processing: legal basis, transparency, data subject rights, security and the record of processing. You must be able to demonstrate compliance.

Art. 4(7) · Art. 5(2) · art. 24 · art. 30

Outcome C · Applies

You are the controller and need a processing agreement

Only use processors that provide sufficient guarantees. Set out in an agreement the subject matter, duration, nature and purpose, type of data and categories of data subjects, and that the processor acts only on your documented instructions, ensures confidentiality, secures the data, engages sub-processors only with your authorisation, assists you with data subject rights and with Articles 32 to 36, deletes or returns data at the end, and allows audits.

Art. 28(1) · Art. 28(3)(a) to h

Outcome D · Applies

You are a joint controller

Set out in a transparent arrangement who fulfils which obligation, in particular for data subject rights and the duty to inform. The essence of that arrangement must be available to data subjects. Data subjects may exercise their rights against each of the controllers.

Art. 26(1) · Art. 26(2) · Art. 26(3)

Outcome E · Applies

You are a processor

You process only on the documented instructions of the controller and according to the processing agreement. Inform the controller immediately if you think an instruction infringes the GDPR. You secure the data, keep your own record of processing and notify data breaches to the client without undue delay.

Art. 4(8) · Art. 28(3) · art. 29 · Art. 30(2) · art. 32 · Art. 33(2)

Outcome F · Applies

You are a processor engaging a sub-processor

You need prior specific or general written authorisation from the controller; with general authorisation you inform the controller of each change so that it can object. Impose the same obligations on the sub-processor. If it fails to fulfil its obligations, you remain fully responsible for that towards the controller.

Art. 28(2) · Art. 28(4)

Outcome G · Check further

For your own purposes you are the controller

A processor that, in breach of the GDPR, determines purpose and means itself is considered the controller for that processing. For use for your own purposes, such as training your own model, you then need your own legal basis and must inform data subjects. Without a legal basis and agreement with the client, that use is not permitted.

Art. 28(10) · Art. 6(1) · art. 14

Outcome H · Check further

Role cannot be established: look again at the facts

Whoever neither determines purpose and means nor processes on behalf of another may be a recipient or a staff member acting under the controller’s authority. Map per processing operation who takes which decisions.

Art. 4(9) · Art. 4(10) · art. 29

What does this mean for you?

Controller

Use only processors that demonstrably provide sufficient guarantees (paragraph 1) and put a written contract in place with each processor covering all the elements of paragraph 3 (paragraph 9). Decide in advance whether and how the processor may engage other processors and keep the ability to object (paragraph 2). Use your right to information and audits to check that the arrangements are being followed (paragraph 3(h)).

Processor

Process only on documented instructions from the controller and warn the controller immediately if you think an instruction infringes the GDPR (paragraph 3(a) and the final subparagraph of paragraph 3). Do not engage another processor without written authorisation and impose the same obligations on that other processor; you remain fully liable to the controller for what that other processor does (paragraphs 2 and 4). If you determine the purposes and means of processing yourself, you are treated as a controller for that processing (paragraph 10).

Data Subject

You do not need to do anything yourself. The article protects you because the controller may only use processors that provide sufficient guarantees for the protection of your rights (paragraph 1) and the processor must help answer your requests, such as access or erasure (paragraph 3(e)).

Compliance checklist

Before engaging each processor, it has been assessed and recorded that the processor provides sufficient guarantees for appropriate technical and organisational measures (paragraph 1).A written or electronic contract exists with each processor describing the subject matter, duration, nature and purpose of the processing, the type of personal data, the categories of data subjects and the obligations and rights of the controller (paragraphs 3 and 9).The contract contains all the obligations in paragraph 3(a) to (h), including processing on documented instructions, confidentiality, security under Article 32, assistance with data subject requests and deletion or return at the end of the services.The processor engages other processors only with prior specific or general written authorisation and, under a general authorisation, informs the controller of every intended change so that the controller can object (paragraph 2).Every other processor is bound by contract to the same obligations as those in the contract between controller and processor (paragraph 4).The processor has a procedure to inform the controller immediately if, in its opinion, an instruction infringes the GDPR (paragraph 3, final subparagraph).The processor makes available all information needed to demonstrate compliance and contributes to audits and inspections by or on behalf of the controller (paragraph 3(h)).

Related recitals

(81)

To ensure compliance with the requirements of this Regulation in respect of the processing to be carried out by the processor on behalf of the controller, when entrusting a processor with processing a...

(82)

In order to demonstrate compliance with this Regulation, the controller or processor should maintain records of processing activities under its responsibility. Each controller and processor should be ...

Cross-references

Art. 32: Security of processing Art. 40: Codes of conduct Art. 42: Certification Art. 63: Consistency mechanism Art. 93: Committee procedure

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Guidelines and decisions (4)

7 October 2024 · EDPB
Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)
Addresses what controllers must know and verify about their processors and the full chain of sub-processors.
4 June 2021 · (EU) 2021/914 · European Commission
Standard contractual clauses for transfers to third countries
Modular standard contractual clauses for transfers to third countries, with a mandatory assessment of the law and practice in the country of destination.
4 June 2021 · (EU) 2021/915 · European Commission
Standard contractual clauses between controllers and processors
Model clauses parties can use for the processing agreement under Article 28(7).
6 February 2018 · WP257 rev.01 · Article 29 Working Party
Working Document setting up a table with the elements and principles to be found in Processor Binding Corporate Rules
Provides an overview of the mandatory components of binding corporate rules for processors transferring personal data within a group.

Line of case lawWho is the controller?

When are you a (joint) controller?

Google Spain (2014)A search engine is responsible for its own processing of others' publications.
Wirtschaftsakademie (2018)A fan page administrator is responsible together with Facebook.
Jehovan todistajat (2018)An organisation steering processing is jointly responsible, even without access to the data.
Fashion ID (2019)Joint responsibility applies per stage of processing.
Guidelines 07/2020 on the concepts of controller and processor in the GDPR (2021)The EDPB sets out the criteria for controller and processor.
Nacionalinis visuomenės sveikatos centras (2023)Whoever commissions an app and sets its purposes is responsible without processing data itself.
IAB Europe (2024)An industry body imposing a standard can be jointly responsible.
Russmedia Digital (2025)An online marketplace is responsible for personal data in advertisements.

Checked on 5 November 2026

Frequently asked questions

← Art. 27: Representatives of controllers or processors not established in the Union Art. 29: Processing under the authority of the controller or processor →

Connections

Themes where this returns

Who is responsible: roles in both laws

The counterpart in the other law