The processor has duties of its own
A processor is not merely a contractual party: Article 28 imposes direct obligations — no sub-processor without authorisation, confidentiality, Article 32 security, help with rights and breaches, and delete or return the data at the end.
Why it is like this
Under the old directive a processor's only duties ran through the contract, which meant a supervisory authority had nobody to act against. Now it can fine the processor itself.
Not to be confused with
Something the controller can sign away. A clause relieving the processor of Article 28 duties does not bind the supervisory authority, and a processor going beyond its instructions becomes a controller for that processing.
In practice
A processor that suffers a breach must notify the controller without undue delay — it has no 72-hour clock of its own, and no direct line to the authority.
Source: Regulation (EU) 2016/679 (GDPR) — Article 28. Read on .
Odd one out Check yourself
Three of these are the processor's own duty under Article 28. Which one is not?
Show the answer
Notify the supervisory authority within 72 hours
The 72-hour clock is the controller's. The processor's duty is to tell the controller promptly, which is what makes the controller's clock runnable.