GDPR Article 28 — Data Processing Agreements

Where processing is carried out by a processor on behalf of a controller, a binding contract (DPA) must be in place. All sub-processors must also be authorised and subject to equivalent obligations. Track DPA status, expiry, and audit history here.