GDPR Data Processing Agreement (Article 28): Template and Checklist

Article 28 Checklist

• Subject matter, duration, nature, purpose, data types, categories of data subjects
• Controller instructions and processor duty to inform if an instruction infringes GDPR
• Confidentiality commitments for persons authorised to process
• Security measures aligned to Article 32
• Prior written authorisation for sub-processors + equivalent obligations
• Assistance with DSARs, DPIAs, prior consultation, and breach notification
• Deletion or return of personal data after end of services
• Information necessary to demonstrate compliance / audits

Template Section Headings

Use these headings in counsel-reviewed agreements: Definitions · Processing details (annex) · Instructions · Security · Sub-processors · International transfers (Chapter V) · Assistance · Breach notice timelines · Audit · Term & deletion · Liability / insurance (commercial).

How CyberSilo Helps

• Vendor/DPA register in CSA with renewal and sub-processor change alerts
• Link to CyberSilo’s published DPA for customers

Frequently Asked Questions

Is a click-through ToS enough?

Only if it includes the Article 28 mandatory content and is binding. Many SaaS ToS packages need a dedicated DPA annex.

Who notifies the supervisory authority of a breach?

Controllers notify under Article 33. Processors must notify the controller without undue delay after becoming aware.

Where is CyberSilo’s DPA?

https://cybersilo.tech/dpa

Related GDPR Resources

GDPR hub · CyberSilo DPA · SaaS obligations · Transfers · CSA