Article 28(3) requires a DPA to contain defined subject matter, instructions, confidentiality, security, assistance, deletion or return, and audit provisions. DPAs routinely fall short because they are treated as boilerplate schedules to commercial contracts rather than as independent instruments with mandatory EU-law content. A first read can therefore miss gaps with material liability consequences.
Article 28 GDPR governs particular features of the controller-processor relationship. Omitting one is not simply a departure from preferred drafting practice. It leaves the agreement legally deficient, with the missing requirement readily identifiable during supervisory scrutiny after a data incident.
The Article 28(3) Checklist: Required Content
Article 28(3) sets the minimum contents of a controller-processor DPA. Each subparagraph covers a separate duty, so any omission leaves a distinct compliance deficiency.
The agreement must state the subject matter, duration, nature and purpose of processing, personal-data types, and data-subject categories. "Processing necessary to provide the services" is too indeterminate. The clause should identify the data involved, such as employee data, customer payment data, or health records, and the operations performed, including storage, transmission, analysis, and deletion.
Under Article 28(3)(b), the processor may act only on the controller's documented instructions. The DPA should establish how instructions are issued and what follows when the processor considers one inconsistent with GDPR. Frequently, the text stops at a generic acknowledgment and supplies no procedure.
Article 28(3)(e) and (f) concern data-subject rights and security. The processor must help the controller handle requests under Articles 15 through 22, including access, rectification, erasure, portability, restriction, and objection. The agreement should state the assistance process and timing. A single broad undertaking does not explain either.
Sub-Processor Authorization: Specific or General
Article 28(2) permits sub-processors with either specific or general written authorization. Enterprise SaaS terms generally use general authorization, allowing sub-processors subject to notification. GDPR permits that structure, but only subject to its stated conditions.
With general authorization, the processor must notify the controller before adding or replacing a sub-processor, allowing an objection. The DPA should address the notice period, typically 30 days for DACH-facing agreements, the objection format, and the consequence where the objection cannot be accommodated.
Article 28(4) extends the processor's DPA duties to the sub-processor. The agreement should state that this flow-down occurs and, preferably, identify the sub-processor contract used. "Equivalent obligations" alone is insufficient if the DPA explains neither the process nor the mechanism, leaving the controller without meaningful visibility into the sub-processing chain.
Data Transfer Mechanisms After Schrems II
Where a DPA covers transfers outside the EU/EEA, it must identify and record the applicable mechanism. After the CJEU judgment in Data Protection Commissioner v. Facebook Ireland, Schrems II, C-311/18, transfers to the United States could no longer rely on Privacy Shield. The available framework includes the EU-US Data Privacy Framework, based on the adequacy decision of July 2023, SCCs under Commission Decision 2021/914, and other mechanisms under GDPR Article 46.
DPAs often omit the transfer basis or cite a framework that is no longer current. AI clause extraction can show whether a transfer provision exists, names a mechanism, and refers to one with continuing legal validity. The check is simple, yet ancillary-document treatment causes it to be missed.
Security Measures and the Article 32 Gap
Article 28(3)(c) requires measures appropriate under Article 32. DPAs often incorporate a security annex by reference. That reference matters only if the annex is attached and contains actual measures. "Security measures set out in Annex B" is inadequate when Annex B is absent or merely general, a defect revealed by checking both its existence and contents.
Article 32 calls for risk-appropriate measures, including encryption, pseudonymization where appropriate, continuing confidentiality and integrity, and regular testing and evaluation. "Industry-standard encryption" says less than a schedule listing concrete controls and their implementation. AI extraction brings the security wording into view, enabling the attorney to judge whether its level of detail is sufficient.
Audit Rights: The Clause Often Negotiated Away
Article 28(3)(h) requires the processor to provide information needed to demonstrate Article 28 compliance and to permit and support audits, including inspections, by the controller or an auditor it appoints.
Processor templates often narrow this right to written information, exclude on-site inspections, permit audits only by accredited third parties, or require 30 to 90 days of advance notice. Acceptability depends on the processing and data sensitivity. The attorney must therefore read the operative audit wording in context rather than rely on a general acknowledgment of the obligation.
Distinguishing a DPA from a Joint Controller Agreement
A frequent GDPR review error is treating joint controllers as controller and processor. Article 26 GDPR applies where two or more controllers jointly determine processing purposes and means. They must establish a separate arrangement allocating their respective responsibilities.
AI clause extraction may identify wording that points to joint decisions about the purposes and use of data, rather than one party merely following the other's instructions. That can indicate an Article 26 issue instead of an Article 28 relationship. The classification still depends on legal assessment of the real processing arrangement, but locating the signal is the essential first step.
AI clause extraction against a DPA checklist distinguishes present versus absent content and flags departures from ordinary compliance patterns. It does not determine whether the organization's actual processing practices match the agreement. That question calls for process review, not document review, and remains with the attorney.
Send Alawyer a PDF or DOCX and inspect the result within 90 seconds. Use the free 14-day trial, with no credit card required.
Start Free Trial