Lion Cipher Lab
Review a data processing agreement against GDPR Article 28
- GRC / Compliance
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Almost every organization hands personal data to vendors: a payroll provider, an email platform, a support desk, a cloud host. Under the EU General Data Protection Regulation, the organization that decides why and how data is processed is the controller, and a vendor that processes it on the controller's behalf is a processor. Article 28 says the relationship must be governed by a contract with specific, mandatory contents. These include processing only on documented instructions, confidentiality, security measures, rules for sub-processors, help with data-subject rights and breaches,…
What you'll learn
- the controller and processor roles under GDPR
- the mandatory contents of an Article 28(3) contract
- sub-processor authorization and flow-down (Art. 28(2) and 28(4))
- the processor's breach-notification duty (Art. 33(2))
- reviewing a vendor DPA clause by clause
- writing a redline table for negotiation
- when the Commission's standard clauses help
Steps in this lab
- Controller, processor, and why Article 28 needs a contract
- Build the review checklist from the Article itself
- Read the vendor's DPA
- Find the six gaps
- Write the redline table
- Where this review fits, and what it does not cover