GDPR Article 28
GDPR Article 28 defines the contract between a Data Controller and a Data Processor and sets minimum requirements including security, confidentiality, and subprocessor transparency.
Definition
Article 28 of the General Data Protection Regulation (GDPR) governs the relationship between a Data Controller (the organization that decides why and how personal data is processed) and a Data Processor (a party processing data on the controller's behalf). The article requires a written contract — commonly called a Data Processing Agreement (DPA) — covering processing purposes, types of data, duration, technical and organizational security measures, confidentiality obligations, assistance with data subject rights, breach notification, and prior authorization for subprocessors.
Why it matters
Article 28 is the legal mechanism through which enterprise SaaS vendors become accountable under GDPR. Without a compliant DPA, a customer cannot lawfully share personal data with a third-party processor. Regulators and auditors check DPA presence and scope during inspections, and insurance policies often require them.
How Volentis.ai handles it
Volentis.ai positions itself as a Data Processor under Article 28 for customer content. Contractual processing terms, exact data-residency commitments, subprocessors, and security measures should be confirmed in the current DPA and customer agreement. Public product copy emphasizes EU data residency, no training on customer data, encryption at rest and in transit, and enterprise access controls.