What is data processing?

What does Art. 28 GDPR regulate?

Anyone who has a service provider process personal data on their behalf remains responsible. Under Art. 28(1) GDPR, they may therefore only work with processors that provide sufficient guarantees for appropriate technical and organisational measures. The basis is a data processing agreement (DPA). Under Art. 28(3) GDPR, it sets out, among other things: the subject matter and duration, the nature and purpose of the processing, the type of data and the categories of data subjects. It also obliges the service provider to act only on documented instructions, to ensure confidentiality, to implement the security measures under Art. 32 GDPR, to assist with data subject rights, to delete or return data after the end of the contract and to allow audits. The provider may only engage further sub-processors – such as a data centre – with the prior authorisation of the controller (Art. 28(2) GDPR).

In marketing, chains quickly form: campaign platform, hosting, email and SMS sending, lettershop. Each link needs a clear contractual classification. Financial entities additionally assess such service providers as ICT third-party service providers under Regulation (EU) 2022/2554 (DORA).