Reading a processor contract without being a lawyer: the eight points of Article 28

Regulation (EU) 2016/679 requires that the use of a processor be governed by a contract or another legal act that binds the processor to the controller and sets out the subject matter and duration of the processing, its nature and purpose, the type of data and the categories of data subjects, and the obligations and rights of the controller.¹ It then lists eight obligations that this contract must provide for. The list is closed and easy to check. For a site operator who is not a lawyer, it is the only reading grid needed to tell whether the document being presented is complete.

Completeness, however, is not the same thing as balance. A contract can tick all eight boxes and still contain, in the clauses around them, two or three stipulations that commit you far more than the eight do.

The eight mandatory items

One. The processor processes the data only on documented instructions from the controller, including as regards transfers to a third country, unless it is required to do otherwise by a legal obligation, in which case it informs the controller before the processing, unless the law prohibits this on important grounds of public interest.² The phrase “documented instructions” is the pivot of the whole structure: it is what separates an executor from a decision-maker.

Two. The persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.³

Three. The processor takes all the security measures required by Article 32.⁴ This cross-reference is what justifies the technical annex that most contracts call technical and organisational measures.

Four. It respects the conditions for engaging another processor, laid down in paragraphs 2 and 4 of Article 28.⁵ This point deserves a section of its own, further down.

Five. It assists the controller, by appropriate technical and organisational measures and insofar as this is possible, in fulfilling its obligation to respond to requests for the exercise of data subjects’ rights.⁶ Keep in mind: assist, not answer. The answer remains owed by the controller.

Six. It assists the controller in ensuring compliance with the obligations on security, breach notification and impact assessment, taking into account the nature of the processing and the information available to it.⁷

Seven. At the choice of the controller, it deletes all the data or returns it at the end of the service, and deletes existing copies, unless Union or national law requires their storage.⁸ Note the phrase “at the choice of the controller”: the choice is yours, and a contract that decides in your place departs from the text.

Eight. It makes available to the controller all the information necessary to demonstrate compliance with these obligations, and allows for and contributes to audits, including inspections, conducted by the controller or by an auditor mandated by it.⁹

The same Article adds an obligation that is not a contractual item but a permanent duty of the provider: it immediately informs the controller if, in its opinion, an instruction infringes the Regulation.¹⁰

A contract that lacks any one of these eight items is not compliant. Checking takes ten minutes and, in the event of an inspection, puts you on the right side of the demonstration.

What is not on the list, and matters more

Sub-processing, and authorisation given in advance

Article 28(2) lays down a simple principle: the processor does not engage another processor without the prior written authorisation of the controller, whether specific or general. In the case of general authorisation, it informs the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object.¹¹ And paragraph 4 specifies that the same data protection obligations must be imposed on the sub-processor, the first processor remaining fully liable to the controller for the performance of the other’s obligations.¹²

In practice, almost every contract on the market opts for general authorisation and attaches a list. That is legitimate. The point of vigilance is not the list itself but its composition. A hosting provider, a backup service, a telephony provider or accounting software are support services, with no purpose of their own regarding your data. An advertising retargeting network, a data enrichment supplier or a pooled audience-measurement partner belong to another category: they pursue a purpose of their own, and their presence in a list of sub-processors is a question, not a given.

The rule for reading is this: read the column that describes the service. When a contract itself distinguishes ancillary services from main services, what it files under main services is what touches the core of the processing, and that is where to look twice.

The audit, and the price of exercising it

The eighth point grants a right of audit. Contracts frame it, which is normal: notice period, frequency, possible substitution by a certification or an independent auditor’s report. What takes longer to read is the cost clause. A stipulation that places on you the costs of third parties incurred by an inspection does not remove the right, it moves its cost. The right remains, and exercising it becomes a budgetary decision.

Where the processing takes place

Nothing obliges a contract to confine the processing to the European Economic Area. When it does, that is a favourable clause, and it should be spotted as such: it spares you from having to check the safeguards of Articles 44 and following yourself for each transfer. When it does not, the question of the basis for the transfer becomes yours again.

A useful reminder for a company established in Switzerland: from the Regulation’s point of view, Switzerland is a third country, but a third country that benefits from an adequacy decision. A flow to a Swiss controller therefore requires no additional instrument. This point is developed in the third instalment of this series.

The form of conclusion

Article 28(9) allows the electronic form.¹³ Most platforms draw the maximum consequence: the contract is concluded by submitting a form, without a signature, with a logged timestamp.

This mechanism has a practical implication that is discovered too late. The contract is generated from the account data at the moment of the click. If the company name, address or country are wrong or incomplete in the account, they are wrong in the contract, and it will have been concluded in the name of a poorly identified party. Correcting the account data is not a formality to be done afterwards. It is done beforehand.

The contract you do not have to write

Paragraph 7 of Article 28 provides that the Commission may lay down standard contractual clauses.¹⁴ It has done so through Implementing Decision (EU) 2021/915, which sets out standard clauses between controllers and processors within the meaning of Article 28(7). This set of clauses must not be confused with the standard contractual clauses for transfers to third countries, adopted the same year and serving a different purpose.

The value of this text, for an operator without a legal department, is twofold. It supplies a usable model when you are the one who has to propose the contract, for instance to a provider smaller than yourself. And above all it supplies a yardstick: a contract submitted to you can be compared, clause by clause, with what the Commission judged sufficient.

Under Swiss law

The Federal Act on Data Protection (FADP) does not draw up a list of eight items. Its Article 9 sets three substantive conditions: that the processor carries out only the processing that the controller would be entitled to carry out itself, that no statutory or contractual duty of secrecy prohibits it, and that the controller ensures that the processor is able to guarantee data security.¹⁵ Sub-processing requires the controller’s prior authorisation.¹⁶

The approach is shorter and less formalistic. It is no less demanding on the point that matters: it falls to the controller to make sure, and that assurance must be capable of being demonstrated. How the two regimes overlap for a Swiss business is covered in a separate article.

The grid, in six lines

A processor contract submitted to you can be reviewed with six questions. It first has to be true that the provider is really a processor, which the review examines in another article.

Are all eight items of Article 28(3) present?

Who is on the list of sub-processors, and does any of them pursue an advertising or commercial purpose of its own?

Is the processing confined to the European Economic Area, and if not, what basis do the transfers rest on?

Does the choice between return and deletion of the data at the end of the contract really belong to you?

Is the right of audit accompanied by a cost clause, and which one?

Are your company’s identification details, as they will be carried into the header at the moment of the click, accurate?

None of these six questions requires legal training. All of them require opening the document.

Notes

1. Regulation (EU) 2016/679, Art. 28(3), introductory sentence. ↩

2. Regulation (EU) 2016/679, Art. 28(3)(a). ↩

3. Regulation (EU) 2016/679, Art. 28(3)(b). ↩

4. Regulation (EU) 2016/679, Art. 28(3)(c). ↩

5. Regulation (EU) 2016/679, Art. 28(3)(d). ↩

6. Regulation (EU) 2016/679, Art. 28(3)(e). ↩

7. Regulation (EU) 2016/679, Art. 28(3)(f). ↩

8. Regulation (EU) 2016/679, Art. 28(3)(g). ↩

9. Regulation (EU) 2016/679, Art. 28(3)(h). ↩

10. Regulation (EU) 2016/679, Art. 28(3), final subparagraph. ↩

11. Regulation (EU) 2016/679, Art. 28(2). ↩

12. Regulation (EU) 2016/679, Art. 28(4). ↩

13. Regulation (EU) 2016/679, Art. 28(9). ↩

14. Regulation (EU) 2016/679, Art. 28(7), and Implementing Decision (EU) 2021/915. ↩

15. Federal Act on Data Protection (SR 235.1), Art. 9(1) and (2). ↩

16. Federal Act on Data Protection (SR 235.1), Art. 9(3). ↩