Establish GDPR-Compliant Data Processing Agreements
What this control requires
Identify all data processors and execute DPAs compliant with Article 28. DPAs must cover: processing instructions, confidentiality, security measures, sub-processor approval, data subject rights assistance, breach notification assistance, deletion/return obligations and audit rights. Maintain a processor register. Review DPAs annually and on contract renewal.
Other GDPR controls
EU_GDPR-CTRL-001 - Daily safeguarding reconciliationEU_GDPR-CTRL-002 - Critical ICT incident reportingEU_GDPR-CTRL-003 - GDPR breach notification workflowEU_GDPR-CTRL-004 - AML suspicious transaction monitoringEU_GDPR-CTRL-005 - Quarterly PCI vulnerability assessmentEU_GDPR-CTRL-006 - Outsourcing provider oversightEU_GDPR-CTRL-007 - DORA Register of Information maintenanceEU_GDPR-CTRL-008 - CTIF suspicious activity escalationEU_GDPR-CTRL-009 - NIS2 cyber resilience testingEU_GDPR-CTRL-010 - Instant payment availability monitoringGDPR-A28-001 - Data Processor Management and DPA ProgrammeGDPR-A30-001 - Record of Processing Activities Maintenance