Art.28 Processor
Use only processors providing sufficient guarantees to implement appropriate technical and organisational measures such that the processing meets the Regulation's requirements and protects the rights of the data subject.
5
artefacts
0
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Due diligence evidence gathered before appointment showing sufficient guarantees, distinct from the signed contract · Vendor register / contract repository
- The sub-processor authorisation position for each processor, the current sub-processor list, and evidence changes were notified · Document repository
governing documentDocuments that govern the control
- A processor inventory reconciled against the vendor register or accounts payable, so no processor is missing from it · Policy repository / GRC workspace
- The Article 28(3) contract for each processor, checked clause by clause against the eight stipulations the Article names · Vendor register / contract repository
- Audit or assurance rights exercised in practice, such as a report reviewed with findings tracked, and end of service deletion certificates · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- The processor's own standard terms accepted, which commonly omit the audit right, the deletion choice and the instruction infringement notice
- A processor inventory that misses tools adopted directly by individual teams, which is where undocumented processing usually sits
- Sufficient guarantees evidenced only by the existence of the contract, with no assessment carried out before appointment
- Sub-processor lists published by the processor and never actually reviewed, so the right to object is theoretical
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.27 Representatives of controllers or processors not established in the Union · Art.29 Processing under the authority of the controller or processor