Article 28 of GDPR
Data processing agreement


Who is obliged to stipulate

All companies that outsource data processing activities to third parties (such as to accounting companies, IT system administrators etc.)


Data processing contract in accordance with Article 28 of GDPR with the following typical content:

  • description of personal data to be processed by the data processor,
  • description of individual tasks regarding the processing of such data,
  • description of mutual rights and obligations of the personal data filing system controller and processing official,
  • description of the appropriate technical, organizational and staffing measures that shall be carried out by the data processor for the protection of personal data.


Standard contractual clauses (Article 28 of GDPR)