GDPR Data Processing Agreement (Article 28): Template and Checklist

When a processor processes personal data on a controller’s behalf, Article 28 requires a binding contract (the Data Processing Agreement). Controllers must use only processors that provide sufficient guarantees.

CyberSilo’s own processor terms live at cybersilo.tech/dpa. This page is the educational template/checklist for your broader vendor estate.

Related: GDPR hub · GDPR for SaaS · RoPA.

Art 28 essentials: documented instructions, confidentiality, Art 32 security, sub-processor authorisation and flow-down, assistance with rights/DPIA/breach, audit/information rights, and deletion or return at end of service.

Article 28 Checklist

Subject matter, duration, nature, purpose, data types, categories of data subjects
Controller instructions and processor duty to inform if an instruction infringes GDPR
Confidentiality commitments for persons authorised to process
Security measures aligned to Article 32
Prior written authorisation for sub-processors + equivalent obligations
Assistance with DSARs, DPIAs, prior consultation, and breach notification
Deletion or return of personal data after end of services
Information necessary to demonstrate compliance / audits

Template Section Headings

Use these headings in counsel-reviewed agreements: Definitions · Processing details (annex) · Instructions · Security · Sub-processors · International transfers (Chapter V) · Assistance · Breach notice timelines · Audit · Term & deletion · Liability / insurance (commercial).

How CyberSilo Helps

Vendor/DPA register in CSA with renewal and sub-processor change alerts
Link to CyberSilo’s published DPA for customers

Close the Processor Contract Gap

Inventory processors, attach Art 28 DPAs, and track sub-processor changes before the next supervisory review.

Talk to CyberSilo GDPR Automation

Frequently Asked Questions

Is a click-through ToS enough?

Only if it includes the Article 28 mandatory content and is binding. Many SaaS ToS packages need a dedicated DPA annex.

Who notifies the supervisory authority of a breach?

Controllers notify under Article 33. Processors must notify the controller without undue delay after becoming aware.

Where is CyberSilo’s DPA?

https://cybersilo.tech/dpa

GDPR hub · CyberSilo DPA · SaaS obligations · Transfers · CSA

GDPR Data Processing Agreement (Article 28): Template and Checklist

Article 28 Checklist

Template Section Headings