# Processors and data processing agreements What a controller must check before using a processor, the terms Article 28 requires in the contract, and how sub-processors are approved and bound. Source: https://sted.digital/docs/standards/gdpr/processors-and-contracts · Last reviewed 17 October 2026 · Strand Standards and regulations UK GDPR Article 28 lets you use only processors that can protect the data, under a written contract binding them to act on your instructions, keep data confidential and secure, control sub-processors, help you meet your duties, and delete or return the data at the end. EU GDPR has the same article. ## The requirement in plain English A [processor](/docs/glossary/controller-and-processor) handles personal data on your behalf: your cloud host, payroll bureau, email platform or outsourced support desk. You stay responsible for the data, so the law makes you choose carefully and contract precisely. The same articles apply in EU GDPR. **Choose with care.** You may use only processors that give you enough assurance that they will apply appropriate technical and organisational measures ([UK GDPR Article 28(1)](https://www.legislation.gov.uk/eur/2016/679/article/28)). That means checking before you sign, not trusting the brand. **Contract in writing.** The contract must set out the subject matter, duration, nature and purpose of the processing, the types of data and people, and your rights and obligations. It must then bind the processor to (UK GDPR Article 28(3)): - act only on your documented instructions, including on transfers abroad, and tell you if an instruction seems unlawful; - make sure the people handling the data are bound to confidentiality; - take the security measures Article 32 requires; - use sub-processors only with your authorisation and on the same terms; - help you answer individuals' rights requests; - help you with security, breach notification and impact assessments; - delete or return the data when the service ends, as you choose; - give you the information you need to show compliance, and allow audits and inspections. **Sub-processors.** A processor needs your prior written authorisation, specific or general, to engage another processor; under a general authorisation it must tell you about changes so you can object (UK GDPR Article 28(2)). It must pass the same obligations down and stays liable to you for the sub-processor (UK GDPR Article 28(4)). **Role drift.** A processor that starts deciding its own purposes and means becomes a controller for that processing (UK GDPR Article 28(10)). Two organisations deciding purposes together are joint controllers, which needs a different arrangement (UK GDPR Article 26). Processors also keep their own record of processing (UK GDPR Article 30(2)) and act only on instructions (UK GDPR Article 29). UK GDPR The UK GDPR lets the ICO adopt standard clauses for processor contracts (UK GDPR Article 28(8)). Most UK organisations draft their own terms or use the supplier's agreement, checked against the Article 28(3) list. The European Commission's processor clauses can be used as a drafting source but have no formal status under the UK GDPR. EU GDPR In the EU, the European Commission has adopted standard contractual clauses for contracts between controllers and processors (EU GDPR Article 28(7), Implementing Decision (EU) 2021/915). Using them unchanged meets Article 28(3) and (4). They are separate from the transfer clauses used to send data outside the European Economic Area. This is guidance to help you understand the requirement, not legal advice. ## What good looks like A 45-person software company runs every new supplier through one approval step before anyone signs or connects it. The requester names the data the supplier will touch. If it is personal data, the privacy lead decides the supplier's role, then checks its security evidence (a certificate, a report or a short questionnaire), its location and sub-processors, and its data processing agreement against the Article 28 list. The approval is recorded with the criticality tier, the evidence reviewed, the date the agreement was signed and any gaps accepted with a reason. The supplier is added to the record of processing as a recipient. Each processor is reviewed once a year, sooner for critical ones: is the agreement still the current version, have sub-processors changed, did any incident occur? Sub-processor change notices go to one shared inbox the privacy lead watches, and the objection window each agreement gives is written on the supplier's file. When a supplier leaves, the company asks for written confirmation of deletion or return. ## Evidence an auditor expects - **Data processing agreements**: required for every processor; the auditor samples them against the Article 28(3) list. - **Supplier due diligence**: required in substance by Article 28(1); the auditor looks for evidence reviewed before signature, not after. - **Supplier register or approval records**: usual; the auditor checks every processor in the record of processing has one. - **Sub-processor authorisations and change notices**: required where sub-processors are used; the auditor checks objections were considered. - **Annual reviews**: usual; the auditor checks for dated reviews of critical processors. - **Exit evidence**: usual; confirmation of deletion or return from former processors. ## Common mistakes ### No contract for small tools Teams sign up for a survey tool or a scheduling app on a card, and nobody checks the terms. Any tool that holds personal data for you is a processor, however small the bill. ### The agreement signed, never read Many supplier agreements omit the audit right, or make deletion optional. Check each term against the list, and record what you accepted. ### Treating every supplier as a processor Signing an Article 28 agreement with a supplier that is really a controller, such as a professional adviser, blurs who is responsible for what. Decide the role first. ### Ignoring sub-processor notices General authorisation only works if you read the change notices. A new sub-processor in another country can also be a new international transfer. ### Forgetting your own processor role A software company processing its clients' data must meet Article 28 from the other side: follow instructions, flow terms down to its own sub-processors, and keep a processor record. ## How Sted helps Sted's knowledge base includes a Supplier Approval Record (REC-SAR) under the Supplier Approval and Management Procedure (PRC-SAMP), which records the supplier's criticality, the information security and data protection review, and whether its data processing agreement is signed and holds the required processor terms. Records are part of the Full Management System plan. Sted treats UK GDPR, and separately EU GDPR, as applying when you process any personal data and are established in that territory or offer goods or services to, or monitor, people there; it reads your controller and processor roles from your processing activities, notes when an Article 27 representative is needed, and holds its confidence at medium until a processing activity is recorded. For UK GDPR and for EU GDPR Sted's knowledge base carries 34 policies, procedures and notices and 35 record templates each, led by the Personal Data Protection Policy, the Data Subject Rights Handling Policy, the Data Retention and Erasure Policy and the two privacy notices. Sted does not assess your suppliers or review their agreements for you. You carry out the review and record its outcome. ## Related guides and terms - [Supplier due diligence](/docs/guides/supplier-due-diligence): how to check a supplier before you sign. - [Controller and processor](/docs/glossary/controller-and-processor): telling the two roles apart. - [International data transfers](/docs/standards/gdpr/international-transfers): what applies when the processor is abroad. - [Personal data breaches](/docs/standards/gdpr/personal-data-breaches): why the processor's duty to tell you matters. - [UK GDPR and EU GDPR](/docs/standards/gdpr): where processors fit in the regulation. - [Records](/docs/product/records): where supplier approvals are recorded in Sted. - [Data protection impact assessments](/docs/standards/gdpr/dpias): the assessments the contract obliges your processor to help with. ## Frequently asked questions Q: Is every supplier that touches personal data a processor? A: No. A processor acts only on your instructions and for your purposes, like a payroll bureau or a cloud host. A supplier that decides its own purposes for the data, such as your bank or an accountant giving professional advice, is a controller in its own right and needs no Article 28 contract. Q: Can I accept a supplier's standard data processing agreement? A: Yes, if it contains every term Article 28 requires. Large providers rarely negotiate, so check their agreement against the list, note any gaps, and decide whether the risk is acceptable. Keep that check with the supplier's file.