GDPR Article 28 Processor Due Diligence — 25 questions every EU controller asks

1. 1.1
   Confirm role as processor (not controller) for the personal data in scope. Provide a clear list of processing activities.
   Critical
2. 1.2
   Provide your standard DPA (Article 28(3) compliant), including SCC modules where applicable.
   Critical
3. 1.3
   Do you act as a joint controller for any data category? Disclose with reasoning.
   High

1. 2.1
   Provide your written TOMs schedule (Article 32) covering encryption, pseudonymisation, confidentiality, integrity, availability, and resilience.
   Critical
2. 2.2
   Encryption — at rest and in transit specifications. Key management residency?
   Critical
3. 2.3
   Access controls — least privilege, MFA, periodic access reviews. Evidence of last review.
   High
4. 2.4
   Logging and monitoring of access to personal data. Retention period for logs.
   High
5. 2.5
   Pen testing and vulnerability management cadence. Most recent executive summary available?
   High

1. 3.1
   Public sub-processor list URL (Article 28(2)) including name, function, country, and data categories accessed.
   Critical
2. 3.2
   Notification period before adding or replacing a sub-processor? Right to object mechanism?
   High
3. 3.3
   Confirm flow-down of Article 28(3) obligations to every sub-processor via written contract.
   Critical

1. 4.1
   Which countries outside the EEA receive personal data? List all transfer mechanisms in use (SCCs 2021, UK IDTA, adequacy, BCRs).
   Critical
2. 4.2
   Have you completed a Transfer Impact Assessment (TIA) following Schrems II and EDPB Recommendations 01/2020? Provide the executive summary.
   Critical
3. 4.3
   Which supplementary measures are in place where the destination country lacks adequacy?
   High

1. 5.1
   Describe how you assist the controller with access, rectification, erasure, restriction, portability, and objection requests. Maximum SLA?
   Critical
2. 5.2
   Are deletions of personal data propagated to backups and analytics stores? Maximum deletion window?
   High
3. 5.3
   Self-service controller console for DSR fulfillment available?
   Medium

1. 6.1
   Commit to written breach-notification SLA — Article 33(2) requires 'without undue delay'; most controllers negotiate 24–48 hours.
   Critical
2. 6.2
   Information you will include in the breach notification — categories of data, approximate number of affected subjects, likely consequences, measures taken.
   High

1. 7.1
   Audit rights — describe how customers can audit your processing (annual third-party audit, customer site visit, pooled audit). Cost allocation?
   High
2. 7.2
   Do you maintain Records of Processing Activities (Article 30) for processor-as-processor activities? Provide a sample.
   High
3. 7.3
   On contract termination, confirm options to delete or return personal data. Maximum deletion-confirmation SLA?
   Critical

Run a free GDPR / EDPB Guidelines audit. ComplianceIQ uses your audit responses and generated policies to populate an answer pack you can paste into any SIG, CAIQ, or custom enterprise questionnaire — in minutes, not days.