# Processor 28(10) — GDPR — provision context

> Focused context for a single provision (28(10)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-28#par-10
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Processor** (GDPR, full article: https://overview.legal/laws/gdpr/art-28).

## Provision text

### 28(10)

Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing.


## Topics on this provision

- **Processors** — https://overview.legal/topics/processors
  Entities that process data on behalf of controllers
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing

## Cited by (exact-provision citations)

- **SO Warszawa - III C 904/23** (case-law) — https://overview.legal/posts/53100
- **Judgment of the Court (Grand Chamber) of 5 December 2023.#Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija.#Request for a preliminary ruling from the Vilniaus apygardos administracinis teismas.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(2) and (7) – Concepts of ‘processing’ and ‘controller’ – Development of a mobile IT application – Article 26 – Joint control – Arti** (case-law) — https://overview.legal/posts/132280
- **Judgment of the Court (Grand Chamber) of 5 December 2023.#Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija.#Request for a preliminary ruling from the Vilniaus apygardos administracinis teismas.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(2) and (7) – Concepts of ‘processing’ and ‘controller’ – Development of a mobile IT application – Article 26 – Joint control – Arti** ¶85 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132280
- **Guidelines 07/2020 on the concepts of controller and processor in the GDPR** (guidance) — https://overview.legal/posts/38069
- **Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR** (guidance) — https://overview.legal/posts/125866

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-28#par-10 · 2026-08-22