What must a processor agreement contain?

What a processor agreement must cover at minimum

A processor agreement should describe what the processor does with personal data on behalf of the controller, and under what conditions. That starts with the basics: the subject matter and duration of the processing, its nature and purpose, the type of personal data involved, and the categories of data subjects concerned. Without this description, it cannot be established whether a supplier is complying with the agreements.

In addition, a number of obligations that derive directly from the GDPR must be included. The processor processes data only on the basis of written instructions from the controller, ensures that persons processing the data are bound by confidentiality, and implements appropriate security measures. It should also be regulated what happens if the processor engages another party (a sub-processor), how the processor assists with requests from data subjects and with the reporting of data breaches, and what happens to the data once the service provision ends — destruction or return. Often it is also stated that the controller may audit whether the agreements are being complied with, for example through an audit.

Where this follows from: Article 28 of the GDPR

This enumeration follows directly from Article 28 of the GDPR, which specifically describes what a processor agreement must contain when a controller engages a processor. The EDPB Guidelines provide further guidance on how these provisions can be implemented in practice, for example when assessing security measures or engaging sub-processors. For the exact wording of each obligation, the text of Article 28 itself remains the starting point.