GDPR processor risk starts with roles. A controller decides why and how personal data is processed. A processor processes personal data on behalf of the controller. The obligations in Article 28 and related GDPR provisions make processor oversight a privacy governance discipline, not a generic vendor checklist.
Official sources
What GDPR is trying to do
GDPR protects personal data and assigns responsibilities based on role. When controllers use processors, they must use processors providing sufficient guarantees and include required terms in a binding agreement. Processors must not engage another processor without authorization and must help with security, breach, deletion or return, and audit obligations.
What teams need to do
- Determine controller, processor, joint controller, and subprocessor roles.
- Map personal data categories, data subjects, purposes, locations, transfers, and retention.
- Put Article 28 processor terms in place.
- Track subprocessor authorization and flow-down obligations.
- Review security measures, breach support, data subject support, deletion or return, and transfer
mechanisms.
Evidence to maintain
- Role analysis and processing inventory.
- Data processing agreements and Article 28 terms.
- Subprocessor records and authorization evidence.
- Security measures, transfer documentation, breach support, and audit evidence.
- Deletion or return records and remediation.
Common gaps
- Vendor inventories do not distinguish controllers, processors, and subprocessors.
- Article 28 terms are assumed but not verified in executed contracts.
- Subprocessor changes do not trigger review.
- Deletion, return, and breach support are not operationalized.
How Halbarad helps
Halbarad helps privacy teams maintain processor records, data categories, subprocessors, contracts, security evidence, breach support, deletion/return obligations, transfer evidence, issues, and audit trail.
Disclaimer
This guide is for general information only and is not legal advice. Review the official regulation, guidance, and supervisory materials, and consult qualified counsel or compliance advisors for your organization's specific obligations.