# Processor 28(2) — GDPR — provision context

> Focused context for a single provision (28(2)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-28#par-2
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Processor** (GDPR, full article: https://overview.legal/laws/gdpr/art-28).

## Provision text

### 28(2)

The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.


## Topics on this provision

- **Processors** — https://overview.legal/topics/processors
  Entities that process data on behalf of controllers
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing

## Cited by (exact-provision citations)

- **Judgment of the Court (Seventh Chamber) of 30 January 2020.#Köln-Aktienfonds Deka v Staatssecretaris van Financiën.#Request for a preliminary ruling from the Hoge Raad der Nederlanden.#Reference for a preliminary ruling — Free movement of capital and liberalisation of payments — Restrictions — Taxation of dividends received by undertakings for collective investment in transferable securities (UCITS) — Refund of tax withheld on dividends — Conditions — Objective differentiation criteria — Criteri** (case-law) — https://overview.legal/posts/132334
- **Judgment of the General Court (Fifth Chamber, Extended Composition) of 24 May 2023.#Meta Platforms Ireland Ltd, formerly Facebook Ireland Ltd v European Commission.#Competition – Data market – Administrative procedure – Article 18(3) and Article 24(1)(d) of Regulation (EC) No 1/2003 – Request for information – Virtual data room – Obligation to state reasons – Legal certainty – Rights of the defence – Necessity of the information requested – Misuse of powers – Right to privacy – Proportionality –** ¶256 (case-law, General Court) — https://overview.legal/posts/132287
- **Judgment of the General Court (Fifth Chamber, Extended Composition) of 24 May 2023.#Meta Platforms Ireland Ltd, formerly Facebook Ireland Ltd v European Commission.#Competition – Data market – Administrative procedure – Article 18(3) and Article 24(1)(d) of Regulation (EC) No 1/2003 – Request for information – Virtual data room – Obligation to state reasons – Legal certainty – Rights of the defence – Necessity of the information requested – Misuse of powers – Right to privacy – Proportionality –** ¶201 (case-law, General Court) — https://overview.legal/posts/132288
- **Judgment of the Court (Seventh Chamber) of 30 January 2020.#Köln-Aktienfonds Deka v Staatssecretaris van Financiën.#Request for a preliminary ruling from the Hoge Raad der Nederlanden.#Reference for a preliminary ruling — Free movement of capital and liberalisation of payments — Restrictions — Taxation of dividends received by undertakings for collective investment in transferable securities (UCITS) — Refund of tax withheld on dividends — Conditions — Objective differentiation criteria — Criteri** ¶12 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132334
- **Judgment of the Court (Seventh Chamber) of 30 January 2020.#Köln-Aktienfonds Deka v Staatssecretaris van Financiën.#Request for a preliminary ruling from the Hoge Raad der Nederlanden.#Reference for a preliminary ruling — Free movement of capital and liberalisation of payments — Restrictions — Taxation of dividends received by undertakings for collective investment in transferable securities (UCITS) — Refund of tax withheld on dividends — Conditions — Objective differentiation criteria — Criteri** ¶9 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132334
- **Opinion 19/2024 on the EuroPrise criteria of certification regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 (GDPR)** (guidance) — https://overview.legal/posts/125722
- **Report of the work undertaken by the ChatGPT Taskforce** (guidance) — https://overview.legal/posts/125752
- **Opinion 7/2024 on the draft decision of the German North Rhine Westphalia Supervisory Authority regarding the EU Cloud Service Data Protection (Auditor) certification criteria** (guidance) — https://overview.legal/posts/125759
- **Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms** (guidance) — https://overview.legal/posts/125765
- **EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679** (guidance) — https://overview.legal/posts/125829
- **Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria** (guidance) — https://overview.legal/posts/125831
- **Statement 1/2023 on the first review of the functioning of the adequacy decision for Japan** (guidance) — https://overview.legal/posts/125837

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-28#par-2 · 2026-08-22