# Processor 28(9) — GDPR — provision context

> Focused context for a single provision (28(9)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-28#par-9
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Processor** (GDPR, full article: https://overview.legal/laws/gdpr/art-28).

## Provision text

### 28(9)

The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form.


## Cited by (exact-provision citations)

- **Guidelines 07/2020 on the concepts of controller and processor in the GDPR** (guidance) — https://overview.legal/posts/38069
- **Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria** (guidance) — https://overview.legal/posts/125965
- **Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria** §57 (guidance, EDPB) — https://overview.legal/posts/125965
- **Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria** §37 (guidance, EDPB) — https://overview.legal/posts/125965

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-28#par-9 · 2026-08-22