GDPR Article 28
GDPR Article 28 defines the contract between a Data Controller and a Data Processor and sets minimum requirements including security, confidentiality, and subprocessor transparency.
Definition
Article 28 of the General Data Protection Regulation (GDPR) governs the relationship between a Data Controller (the organization that decides why and how personal data is processed) and a Data Processor (a party processing data on the controller's behalf). The article requires a written contract — commonly called a Data Processing Agreement (DPA) — covering processing purposes, types of data, duration, technical and organizational security measures, confidentiality obligations, assistance with data subject rights, breach notification, and prior authorization for subprocessors.
Why it matters
Article 28 is the legal mechanism through which enterprise SaaS vendors become accountable under GDPR. Without a compliant DPA, a customer cannot lawfully share personal data with a third-party processor. Regulators and auditors check DPA presence and scope during inspections, and insurance policies often require them.
How Volentis.ai handles it
Volentis.ai operates as a Data Processor under Article 28 for every customer engagement. A standard DPA is signed at contract start; it covers EU-only data residency (Germany and the Netherlands), no-training-on-customer-data, encryption at rest and in transit, and subprocessor transparency. Customers can request the current DPA and subprocessor list before signing.