# Standards and Regulatory References

## Primary Legislation

### GDPR Article 28 — Processor
- **Art. 28(1)**: Controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures.
- **Art. 28(2)**: Processor shall not engage another processor without prior specific or general written authorisation of the controller.
- **Art. 28(3)**: Processing shall be governed by a contract setting out: subject-matter, duration, nature, purpose, type of data, categories of subjects, and obligations including (a)-(h) as detailed in the skill.
- **Art. 28(4)**: Where a processor engages a sub-processor, the same data protection obligations shall be imposed by contract. The initial processor remains fully liable.
- **Art. 28(9)**: The contract shall be in writing, including electronic form.
- **Art. 28(10)**: If a processor determines the purposes and means of processing (acting beyond instructions), the processor shall be considered a controller for that processing.

### GDPR Article 33(2) — Processor Breach Notification
The processor shall notify the controller without undue delay after becoming aware of a personal data breach.

### Commission Implementing Decision (EU) 2021/914 — Standard Contractual Clauses
Adopted 4 June 2021, replacing the previous SCCs under Decision 2010/87/EU. Module Two (Controller to Processor) contains clauses that fulfil Art. 28(3) requirements while also providing the transfer mechanism for international transfers under Art. 46(2)(c).

### GDPR Article 82(2) — Processor Liability
A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.

## Regulatory Guidance

### EDPB Guidelines 07/2020 on the Concepts of Controller and Processor
Key guidance on processor relationships:
- The processor must act on behalf of the controller and under its instructions.
- If the processor determines purposes or essential means independently, it becomes a controller under Art. 28(10).
- Due diligence obligations under Art. 28(1) require the controller to verify the processor's guarantees before engagement and periodically thereafter.
- The DPA is not merely a formality — it must reflect the actual processing relationship.

### ICO Guidance on Contracts and Agreements (UK)
Provides practical templates and checklists for DPA compliance:
- All eight Art. 28(3) elements must be present; absence of any element renders the DPA non-compliant.
- General written authorisation for sub-processors requires a mechanism for the controller to be informed of changes and to object.
- The controller must retain meaningful oversight through audit rights.

### CNIL (France) — Processor Compliance Guide (2023)
Emphasises that:
- Processors have direct obligations under the GDPR (security, breach notification to controller, DPO appointment in certain cases).
- The DPA must contain specific, not generic, descriptions of processing.
- Sub-processor chains must be transparent to the controller.

## Enforcement Precedents

- **Deutsche Wohnen SE (Berlin DPA, 2019, EUR 14.5 million)**: Fined in part for inadequate processor management and data processing agreements that did not meet Art. 28(3) requirements.
- **Clearview AI (Italian Garante, 2022, EUR 20 million)**: Among other violations, found to be processing without a DPA in place with several of its infrastructure providers.
- **Greek DPA — Decision 26/2019 (PricewaterhouseCoopers)**: Found that the processor engaged sub-processors without the controller's prior authorisation, violating Art. 28(2).
- **ICO (UK) — Fines against processors**: The ICO confirmed that processors can be fined directly for security failures under their Art. 28(3)(c) and Art. 32 obligations.

## ISO/IEC Standards

- **ISO/IEC 27701:2019** — Section 8.2.1: PII processor conditions for collection and processing, including contractual requirements aligned with GDPR Art. 28.
- **ISO/IEC 27001:2022** — Annex A Control 5.20 (Addressing information security within supplier agreements): Supports the contractual security requirements in DPAs.