Laws · GDPR ·art-28-par-1 EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
Full text
Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.
How it connects
Cited by
- Guidelines 07/2020 on the concepts of controller and processor in the GDPR
- Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)
- Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement
- Magazine publisher: Insufficient legal basis for data processing
- Actamedica SRL: Insufficient technical and organisational measures to ensure information security
All 51
- Fortum Marketing and Sales Polska S.A.: Insufficient technical and organisational measures to ensure information security
- Sułkowice Cultural Center: Insufficient data processing agreement
- Slane Credit Union Ltd.: Insufficient technical and organisational measures to ensure information security
- Portuguese National Statistical Institute: Non-compliance with general data processing principles
- Universal Life Insurance Public Co Ltd.: Insufficient data processing agreement
- Housing association: Insufficient fulfilment of data breach notification obligations
- POLAND DPA: Insufficient technical and organisational measures to ensure information security
- Vodafone GmbH: Non-compliance with general data processing principles
- McDonald’s Polska Sp. z o.o.: Non-compliance with general data processing principles
- Vodafone – PANAFON A.E.E.T.: Insufficient technical and organisational measures to ensure information security
- Telecommunications operator (operator of electronic communications networks and services): Non-compliance with general data processing principles
- hier
- Study on the secondary use of personal data in the context of scientific research
- EDPB Annual Report 2024
- EDPB comments on European Commission's Guidelines on Art. 28 DSA
- EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT
- EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT
- Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation
- Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV
- Meta Platforms and Others v Bundeskartellamt
- PREMIER RESTAURANTS ROMANIA SRL: Insufficient technical and organisational measures to ensure information security
- UODO reprimands electricity seller for Art. 5, 24, 25, 28, 32 GDPR violations over
- RENAULT COMMERCIAL ROUMANIE S.R.L.: Insufficient technical and organisational measures to ensure information security
- Comune di Velletri: Non-compliance with general data processing principles
- Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (‘‘LED’’) under Article 62 LED
- If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation
- Midlands Regional Hospital Tullamore, County Offaly: Insufficient technical and organisational measures to ensure information security
- EDPB Annual Report 2025
- Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)
- EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro
- EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679
- EDPB Annual Report 2022
- Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR
- EDPB Annual Report 2021
- Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (LED) under Article 62
- Marián Kočner v European Union Agency for Law Enforcement Cooperation (Europol)
- Ligue des droits humains ASBL v Conseil des ministres
- Xabier Ormaetxea Garai and Bernardo Lorenzo Almendros v Administración del Estado
- KPN BV v Autoriteit Consument en Markt (ACM)
- European Commission v Hungary
- European Commission v Republic of Austria
- UODO reprimands hospital for inadequate processor oversight and email security failures
- UODO (Poland) - DKN.5131.5.2025
- District Governor of Lubartów: Insufficient technical and organisational measures to ensure information security
- ZeniΘ (Thessaloniki-Thessalia Gas Supply Company S.A.): Insufficient fulfilment of data subjects rights
- European Commission v Federal Republic of Germany
Related across sources
Opinion 22/2024 certain obligations following from the reliance on processor(s) and sub-processor(s) A dopted 1 Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub - processor(s) Adopted on 7 October 2024 Adopted 2 Executive summary The… Opinion ·EDPB Oct 9, 2024 Processors Controllers Processing Agreement
14/2021 Cypriot court backs DPA fines of €40,000 each on football clubs and €25,000 on processor On 26 July 2021, a journalist informed the Cypriot DPA of a security vulnerability on an online platform. This online platform hosted ticket purchase sites of two Cypriot football… Administrative Court of Cyprus May 12, 2026 Controllers Processors Privacy by Design & Default
Guidelines 07/2020 concepts of controller and processor in the GDPR Guidelines ·EDPB Jul 7, 2021 Controllers Processors Joint Controllers
S 5 SF 65/24 DS SG Nürnberg: MOVEit zero-day cyberattack via processor did not breach Art. 32 GDPR The data subject (a child born in 2018), represented by her parents, was insured with the controller (a statutory health insurance provider) and participated in its digital bonus… Social Court Nuremberg Jun 10, 2026 Processors Controllers Integrity and Confidentiality Principle
Opinion 1/2021 EDPB-EDPS Joint Opinion 1/2021 on standard contractual clauses between controllers and processors Adopted 1 EDPB - EDPS Joint Opinion 1 /2021 on the European Commission’s Implementing Decision on standard contractual clauses between controllers and processors for the matters… Opinion Jan 14, 2021 Controllers Processors International Transfer
W254 2314468-1 The data subject sent an access request to the service provider (the processor) It replied that it held no personal data concerning the data subject in its capacity as controller. It explained that it provided services to N-GmbH and acted as its processor.… BVwG - W254 2314468-1 ·Federal Administrative Court Jul 8, 2026 Controllers Processors Personal Data