GDPR Article 28

What is GDPR Article 28?

GDPR Article 28 is the part of the EU privacy law that sets the rules for using a data processor. A processor is a company that handles personal data on your behalf, such as most SaaS vendors. You, the business that decides why the data is used, are the data controller.

Article 28 says you may only use processors that give "sufficient guarantees" of proper security. It also says the relationship must be covered by a written contract with specific terms. That contract is the data processing agreement (DPA).

If you have customers or users in the EU, the GDPR may apply to you even as a US company, under Article 3(2). Your customers may also ask for Article 28 terms.

What every DPA must contain

Here is a checklist of what Article 28 requires, in plain words. Paragraph numbers point to the text of Article 28.

• A description of the processing (28(3)). What data, about whom, for what purpose and for how long.
• Your instructions only (28(3)(a)). The vendor uses your data only as you instruct, including for transfers outside the EU.
• Confidentiality (28(3)(b)). Staff who see your data are bound to keep it confidential.
• Security (28(3)(c)). The vendor takes the security measures Article 32 requires, often listed as technical and organizational measures.
• Rules for subprocessors (28(2) and 28(4)). The vendor needs your permission to use a subprocessor, must tell you about changes, and must pass the same duties down.
• Help with people's rights (28(3)(e)). The vendor helps you answer requests such as access or deletion.
• Help with security and breaches (28(3)(f)). The vendor helps you meet duties such as breach reporting.
• Return or deletion at the end (28(3)(g)). When the service ends, the vendor deletes or returns your data, as you choose.
• Proof and audits (28(3)(h)). The vendor gives you what you need to show compliance and allows audits, including inspections.
• In writing (28(9)). The contract must be in writing, and electronic form counts.

The EDPB, the body of EU privacy regulators, says a DPA should not just restate the law. It should say concretely how each requirement will be met.

What it looks like in a vendor's terms

A typical clause reads like this:

We will process Customer Personal Data only on your documented instructions, as set out in this DPA and your use of the services. We will tell you if we believe an instruction breaks data protection law. The details of the processing are described in Schedule 1.

• "Documented instructions" is the Article 28(3)(a) duty. The clause defines what counts as your instructions.
• "Your use of the services" means your settings and choices count as instructions too.
• "Tell you if an instruction breaks the law" mirrors a duty in the last part of Article 28(3).
• "Schedule 1" is the description of processing, often called Annex I.

Stripe's DPA, for example, says it will process data "according to User's Instructions".

Documented Instructions

Documented instructions are your written directions to the vendor about what it may do with your data. Under Article 28(3)(a), a processor may process your data only on those instructions, unless a law requires otherwise.

The instructions are rarely a separate letter. Atlassian's DPA defines them as the DPA, the main agreement, your orders and your use of the products, including your settings. The EDPB says instructions can also be given by email or an annex, and should be kept with the contract.

This is where AI training gets tricky. If a vendor uses your data to train its own models for all customers, that is arguably the vendor's own purpose, not yours. Under Article 28(10), a processor that decides the purposes and means of processing is treated as a controller for that processing. Some vendors now train on customer content by default; for example, Venpo reported that Lovable now trains its AI on your prompts and code by default on its Free and Pro plans. Read whether your DPA treats training as your instruction or the vendor's own use.

Description of Processing (Annex I)

The description of processing is the part of a DPA that sets the scope of what the vendor does with your data. Article 28(3) requires it to cover the subject matter and duration, the nature and purpose, the types of personal data and the categories of people involved.

In many DPAs this sits in an annex or schedule. The EU model clauses call it Annex I, and the European Commission's Q&A says it lists categories of people and data, purposes, nature of processing and retention. Atlassian puts it in Schedule 1. Stripe puts it in tables in Section 2 of its DPA.

Why read it? It is the boundary of what you agreed to. The UK regulator, the ICO, says a controller needs to be very clear from the outset about the extent of the processing. If a vendor starts using your data for something new, compare it with this annex. A purpose that is not listed there is a question to ask.

A real change we caught

Article 28 terms live in a contract, and contracts can change. Venpo flagged that Hotjar's DPA can now change without your signature. Since June 2026, the provider can change the DPA at its sole discretion, where before any change needed written agreement from both sides. That means the protections you checked when you signed may not be the ones in force today.

Why it matters to you

If you are the controller, the regulator expects you to have an Article 28 contract with each processor. A missing or weak DPA is your problem, not only the vendor's.

Your own customers often ask for it too. When a customer sends you a DPA request, they may expect the same terms from your vendors.

And the details decide real outcomes: whether you hear about a breach fast, whether you can object to a new subprocessor, and whether your data is deleted when you leave.

What to check

• Walk the DPA through the checklist above and note any item that is missing.
• Read the description of processing and confirm it matches how you use the tool.
• Check how the DPA defines your instructions and whether AI training is included.
• Check whether the vendor can update the DPA without your signature.
• Confirm deletion or return of data at the end, and the timeline.

How Venpo helps

Venpo monitors your vendors' DPAs and subprocessor lists and emails you a plain-English alert when the terms change. The Fine Print Scan also answers whether each vendor trains AI on your data, which ties directly to the instructions question.