# Processor 28(4) — GDPR — provision context

> Focused context for a single provision (28(4)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-28#par-4
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Processor** (GDPR, full article: https://overview.legal/laws/gdpr/art-28).

## Provision text

### 28(4)

Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor's obligations.


## Topics on this provision

- **Processors** — https://overview.legal/topics/processors
  Entities that process data on behalf of controllers
- **Processing** — https://overview.legal/topics/verwerking
  Any operation performed on personal data
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing

## Cited by (exact-provision citations)

- **WELTIMMO S.R.O. V. NEMZETI A DATVEDELMI ES INFORMACIOSZABADSAGH ATOSAG (HUNGARIAN DPA), 1.10.15 (“WELTIMMO”)** (case-law) — https://overview.legal/posts/5956
- **Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV** (case-law) — https://overview.legal/posts/51478
- **VG Ansbach - 14 K 19.01274** (case-law) — https://overview.legal/posts/158450
- **Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV** ¶46 (case-law, CJEU) — https://overview.legal/posts/51478
- **WELTIMMO S.R.O. V. NEMZETI A DATVEDELMI ES INFORMACIOSZABADSAGH ATOSAG (HUNGARIAN DPA), 1.10.15 (“WELTIMMO”)** ¶44 (case-law, CJEU) — https://overview.legal/posts/5956
- **WELTIMMO S.R.O. V. NEMZETI A DATVEDELMI ES INFORMACIOSZABADSAGH ATOSAG (HUNGARIAN DPA), 1.10.15 (“WELTIMMO”)** ¶54 (case-law, CJEU) — https://overview.legal/posts/5956
- **WELTIMMO S.R.O. V. NEMZETI A DATVEDELMI ES INFORMACIOSZABADSAGH ATOSAG (HUNGARIAN DPA), 1.10.15 (“WELTIMMO”)** ¶57 (case-law, CJEU) — https://overview.legal/posts/5956
- **Opinion 18/2021 on the draft Standard Contractual Clauses submitted by the LT SA (Article 28(8) GDPR)** (guidance) — https://overview.legal/posts/126032
- **EDPB-EDPS Joint Opinion 1/2021 on standard contractual clauses between controllers and processors** (guidance) — https://overview.legal/posts/126081
- **Opinion 14/2019 on the draft Standard Contractual Clauses submitted by the DK SA (Article 28(8) GDPR)** (guidance) — https://overview.legal/posts/126212
- **EDPB-EDPS Joint Opinion 2/2021 on standard contractual clauses for the transfer of personal data to third countries** (guidance) — https://overview.legal/posts/126083
- **Guidelines 07/2020 on the concepts of controller and processor in the GDPR** (guidance) — https://overview.legal/posts/38069

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-28#par-4 · 2026-08-22