AI Governance Engineer
GitHub

GDPR Art. 28: processors, incl. AI vendors

Use only processors with sufficient guarantees, under a contract that fixes instructions, sub-processors, security, assistance and deletion

By Reviewed

From clause to evidenceThe chain from GDPR Art. 28 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: General Data Protection Regulation (EU) 2016/679, Art. 28ClauseGDPRArt. 28Duty holder: Controller; processorDuty holderControllerApplies from: 2018-05-25 (In force)Applies from2018-05-25In forceArtefact: AI vendor clause checklist in the due-diligence gate (no training, retention, region, sub-processors, change notice)ArtefactAI vendorclause…Layers: Layer 02 Inventory & Transparency and Layer 05 Assurance & Continuous ComplianceLayersLayer 02Layer 05Evidence record: the common evidence record (Evidence record v1)Evidence recordEvidence recordv1Same topic in 15 frameworks (30 clauses): EU AI Act, ISO 42001, NIST AI RMF, TC260 Framework 3.0, CSA AICM, OWASP LLM,OWASP Agentic and 8 moreAs of 2026-09-24 · illustrative, not a claim of conformity From clause to evidenceThe chain from GDPR Art. 28 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: General Data Protection Regulation (EU) 2016/679, Art. 28ClauseGDPR · Art. 28Duty holder: Controller; processorDuty holderControllerApplies from: 2018-05-25 (In force)Applies from2018-05-25 · In forceArtefact: AI vendor clause checklist in the due-diligence gate (no training, retention, region, sub-processors, change notice)ArtefactAI vendor clause checklist…Layers: Layer 02 Inventory & Transparency and Layer 05 Assurance & Continuous ComplianceLayersLayer 02Layer 05Evidence record: the common evidence record (Evidence record v1)Evidence recordEvidence record v1Same topic in 15 frameworks (30 clauses): EUAI Act, ISO 42001, NIST AI RMF, TC260Framework 3.0, CSA AICM and 10 moreAs of 2026-09-24illustrative, not a claim of conformity
From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-GDPR-ART28. Drawn from chapter 08.
Text alternative
  • Clause: GDPR, Art. 28.
  • Duty holder: Controller.
  • Applies from: 2018-05-25, In force.
  • Artefact: AI vendor clause checklist….
  • Layers: Layer 02, Layer 05.
  • Evidence record: Evidence record v1.
  • Record schema: Evidence record.
  • The same topic in 15 other frameworks; the crosswalk section below links each clause.
When this obligation appliesThe date of AIGE-OBL-GDPR-ART28 on a time axis, against its review date 2026-09-24.Earlier2024202620282030As of 2026-09-242018-05-25 · In force2018-05-25 · In forceSource: Obligation register(chapter 08)
When this obligation appliesThe date of AIGE-OBL-GDPR-ART28 on a time axis, against its review date 2026-09-24.2018-05-25 · In force2024202620282030EarlierAs of 2026-09-242018-05-25 · In forceSource: Obligation register (chapter 08)
When this obligation applies The first date in the row's status, then each later step: filled once its date has passed, outlined while it is still ahead of the review date.
Data table: the dates
Dates of AIGE-OBL-GDPR-ART28
DateStepDetail
2018-05-25In force
Id
AIGE-OBL-GDPR-ART28
Instrument
General Data Protection Regulation (EU) 2016/679 law
Clause
Art. 28
In scope
Controller; processor
Authority
National data protection authority
Applies from
In force

The artefact that evidences it

AI vendor clause checklist in the due-diligence gate (no training, retention, region, sub-processors, change notice).

What this obligation connects toGDPR Art. 28 and its 15 relations: 15 same crosswalk topic.DirectGDPR Art. 28Same crosswalk topic (15)AI Verify 9.7.1, 5.3.1, 4.5.2, 9.3.1 · Core clauseAI VerifyCSA AICM STA-10, STA-09 · Core clauseCSA AICMEU AI Act Art. 25, Art. 25(4), Art. 26, Art. 22, Art. 23, Art. 24, Art. 54 · Core clauseEU AI ActISO 42001 A.10 · Core clauseISO 42001NIST AI RMF GOVERN 6, MAP 4, MANAGE 3, MANAGE 3.1, GOVERN 6.2 · Core clauseNIST AI RMFOWASP Agentic ASI04 · Core clauseOWASP Agentic+9 more+9 more: OWASP LLM LLM04:2026, TC260 Framework 3.0 TC260 App. 2 II.4, TC260 4.4.4, China Deep Synthesis DeepSyn Art. 14, China GenAI Measures GenAI Art. 7, G7 Code G7 Action 11, GAO AI Accountability 2.6, GDPR Arts. 44–46, GPAI Code Transparency 1.2, UK ATRS ATRS 2.1.4
What this obligation connects toGDPR Art. 28 and its 15 relations: 15 same crosswalk topic.DirectSame crosswalk topic (15)AI Verify 9.7.1, 5.3.1, 4.5.2, 9.3.1 · Core clauseAI VerifyCSA AICM STA-10, STA-09 · Core clauseCSA AICMEU AI Act Art. 25, Art. 25(4), Art. 26, Art. 22, Art. 23, Art. 24, Art. 54 · Core clauseEU AI ActISO 42001 A.10 · Core clauseISO 42001NIST AI RMF GOVERN 6, MAP 4, MANAGE 3, MANAGE 3.1, GOVERN 6.2 · Core clauseNIST AI RMFOWASP Agentic ASI04 · Core clauseOWASP Agentic+9 more+9 more: OWASP LLM LLM04:2026, TC260 Framework 3.0 TC260 App. 2 II.4, TC260 4.4.4, China Deep Synthesis DeepSyn Art. 14, China GenAI Measures GenAI Art. 7, G7 Code G7 Action 11, GAO AI Accountability 2.6, GDPR Arts. 44–46, GPAI Code Transparency 1.2, UK ATRS ATRS 2.1.4GDPR Art. 28
What this obligation connects to Solid edges are direct relations, dashed ones looser (a case that cites the same article, a framework whose clauses only touch the topic); patterns and controls take the colour of their stack layer. Select a node to open it; the lists below give every relation in full.
Data table: every relation
Relations of AIGE-OBL-GDPR-ART28
FamilyItemRelation
Same crosswalk topicAI Verify 9.7.1, 5.3.1, 4.5.2, 9.3.1Core clause
Same crosswalk topicCSA AICM STA-10, STA-09Core clause
Same crosswalk topicEU AI Act Art. 25, Art. 25(4), Art. 26, Art. 22, Art. 23, Art. 24, Art. 54Core clause
Same crosswalk topicISO 42001 A.10Core clause
Same crosswalk topicNIST AI RMF GOVERN 6, MAP 4, MANAGE 3, MANAGE 3.1, GOVERN 6.2Core clause
Same crosswalk topicOWASP Agentic ASI04Core clause
Same crosswalk topicOWASP LLM LLM04:2026Core clause
Same crosswalk topicTC260 Framework 3.0 TC260 App. 2 II.4, TC260 4.4.4Core clause
Same crosswalk topicChina Deep Synthesis DeepSyn Art. 14Related clause
Same crosswalk topicChina GenAI Measures GenAI Art. 7Related clause
Same crosswalk topicG7 Code G7 Action 11Related clause
Same crosswalk topicGAO AI Accountability 2.6Related clause
Same crosswalk topicGDPR Arts. 44–46Related clause
Same crosswalk topicGPAI Code Transparency 1.2Related clause
Same crosswalk topicUK ATRS ATRS 2.1.4Related clause

Patterns that build it

No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.

The same topic in other frameworks

From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.

Supply chain and third parties

Source

Chapter 08, section The GDPR, checked against its sources on the review date above.

Machine-readable

Cite this obligation

García Aibar, J. (2026). GDPR Art. 28: processors, incl. AI vendors (AIGE-OBL-GDPR-ART28). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art28. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{GDPR Art. 28: processors, incl. AI vendors (AIGE-OBL-GDPR-ART28)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art28},
  note         = {Version 0.5.0}
}