# Processor 28(1) — GDPR — provision context

> Focused context for a single provision (28(1)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-28#par-1
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Processor** (GDPR, full article: https://overview.legal/laws/gdpr/art-28).

## Provision text

### 28(1)

Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.


## Topics on this provision

- **Personal Data** — https://overview.legal/topics/persoonsgegevens
  Information relating to identified or identifiable natural persons
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing

## Cited by (exact-provision citations)

- **CJEU - C-288/12 - European Commission v Hungary** (case-law) — https://overview.legal/posts/158449
- **Meta Platforms and Others v Bundeskartellamt** (case-law) — https://overview.legal/posts/51482
- **Unabhängiges Landeszentrum für Datenschutz v Wirtschaftsakademie Schleswig-Holstein** (case-law) — https://overview.legal/posts/51477
- **COMMISSION V. GERMANY, 9.Mar.2010 (“GERMANY”)** (case-law) — https://overview.legal/posts/5978
- **Judgment of the Court (Grand Chamber) of 5 March 2024.#Marián Kočner v European Union Agency for Law Enforcement Cooperation (Europol).#Appeal – Law enforcement cooperation – Regulation (EU) 2016/794 – Article 49(3) and Article 50 – Protection of personal data – Unlawful data processing – Criminal proceedings brought in Slovakia against the appellant – Expert’s report drawn up by the European Union Agency for Law Enforcement Cooperation (Europol) for the purposes of the investigation – Retrieval** (case-law) — https://overview.legal/posts/132271
- **CJEU - C-614/10 - Commission v. Austria** (case-law) — https://overview.legal/posts/125643
- **Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV** (case-law) — https://overview.legal/posts/51478
- **UNABHäNGIGES LANDESZENTRUM FüR DATENSCHUTZ SCHLESWIG-HOLSTEIN v. WIRTSCHAFTSAKADEMIE SCHLESWIG-HOLDSTEIN GmbH** (case-law) — https://overview.legal/posts/6136
- **Data Protection Commissioner v. Schrems and Facebook** (case-law) — https://overview.legal/posts/6144
- **WELTIMMO S.R.O. V. NEMZETI A DATVEDELMI ES INFORMACIOSZABADSAGH ATOSAG (HUNGARIAN DPA), 1.10.15 (“WELTIMMO”)** (case-law) — https://overview.legal/posts/5956
- **Judgment of the Court (Third Chamber) of 17 September 2015.#KPN BV v Autoriteit Consument en Markt (ACM).#Request for a preliminary ruling from the College van Beroep voor het Bedrijfsleven.#Reference for a preliminary ruling — Electronic communications networks and services — Universal service and users’ rights — Directive 2002/22/EC — Article 28 — Access to numbers and to services — Non-geographic numbers — Directive 2002/19/EC — Articles 5, 8 and 13 — Powers of the national regulatory authori** (case-law) — https://overview.legal/posts/132360
- **Judgment of the Court (Grand Chamber), 8 April 2014.#European Commission v Hungary.#Failure of a Member State to fulfil obligations — Directive 95/46/EC — Protection of individuals with regard to the processing of personal data and the free movement of such data — Article 28(1) — National supervisory authorities — Independence — National legislation prematurely bringing to an end the term served by the supervisory authority — Creation of a new supervisory authority and appointment of another per** (case-law) — https://overview.legal/posts/132371

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-28#par-1 · 2026-08-22