Deep DiveEU

EU GDPR Vendor Management

Article 28 compliance is a contract and operations discipline, not just a procurement checkbox.

Use the 2021 controller-processor clauses, sub-processor governance, breach-assistance rules, and transfer mapping to keep vendor reality aligned with the paper.

Back to main artifact Review sources

Author

Sorena AI

Published

Feb 21, 2026

Updated

Feb 21, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Feb 21, 2026

Updated Feb 21, 2026

Overview

Vendor compliance fails when contracts say one thing and systems do another. The GDPR standard for processors is not just to sign a DPA. Controllers must use processors providing sufficient guarantees, the contract must contain the Article 28 elements, sub-processor use must be controlled, and the operational reality, security, incident escalation, remote access, transfer routes, retention, and deletion, has to match the contract pack. That is why vendor management under GDPR is a live control framework rather than a procurement document set.

Section 1

1) Role and service-model check before contract drafting

The first failure mode is role confusion. Some service providers act as processors for some tasks and independent controllers for others.

Map the service model before you negotiate clauses.

Identify the subject matter, duration, nature, and purpose of the processing.
Map data categories, data-subject categories, and whether the supplier determines any purposes or essential means itself.
Separate processor services from controller-controlled analytics, benchmarking, or service-improvement uses.
Tie the role map to procurement and security review so the contract follows the real service design.

Section 2

2) Article 28 clause set and the 2021 standard clauses

The contract needs the Article 28(3) and (4) elements, but many organisations still use stale or incomplete clause packs.

The Commission adopted standard controller-processor clauses on 4 June 2021 that can be used or incorporated in broader contracts.

Make sure the agreement covers instructions, confidentiality, security, assistance, deletion or return, audits, and sub-processor controls.
Where the Commission 2021/915 clauses are used, align the annexes with the actual service and data flow.
Remember that the Article 28 standard clauses are not the same thing as Chapter V transfer SCCs.
Keep one source of truth for signed DPA versions and annexes.

Section 3

3) Sub-processor governance and change control

Sub-processor management is often the point where the paper trail breaks. Article 28 requires prior specific or general written authorisation and meaningful change notice.

That needs more than a hidden webpage link.

Maintain the authorised sub-processor list and the notice period for changes.
Require the processor to impose equivalent obligations on each sub-processor.
Check how transfer routes change when new sub-processors or support regions are added.
Keep objection decisions and remediation actions in the vendor record.

Section 4

4) Ongoing monitoring: prove the processor still provides sufficient guarantees

Processor diligence does not end at signature. The controller must keep checking that the practical guarantees still exist.

This is where audit evidence, security evidence, and incident performance matter.

Refresh security evidence, certifications, penetration-test summaries, and incident history on a defined cadence.
Test breach-assistance and escalation performance, not just the contractual wording.
Map each processor to its transfer mechanism, cloud-region choices, and onward transfers.
Retire or renegotiate stale clauses, including any packs that still mention Privacy Shield or obsolete SCC models.

Recommended next step

Keep EU GDPR Vendor Management in one governed evidence system

SSOT can take EU GDPR Vendor Management from reusing this material inside a governed evidence system to a reusable workflow inside Sorena. Teams working on EU GDPR can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Evidence system

Open SSOT for EU GDPR Vendor Management

Start from EU GDPR Vendor Management and keep documents, evidence, and control records in one governed system.

Explore next step

Talk to Sorena

Talk through EU GDPR

Review your current process, evidence gaps, and next steps for EU GDPR Vendor Management.

Explore next step

Primary sources