Agent WranglersProcessors and transfers Required
Check each agreement covers Article 28
Check every data processing agreement against the list in GDPR Article 28(3), and record the result and the breach notice deadline in the vendor register.
How to do it
Article 28(3) asks for eight things. The processor acts only on your written instructions and keeps staff bound to confidentiality. It secures the data under Article 32 and uses subprocessors only with your approval. It helps with data requests and breaches, deletes or returns data at the end, and allows audits. Also note how many hours the vendor has to tell you about a breach. Aim for 48 hours or less, so your own 72-hour clock still works.
Example
article_28:
documented_instructions: true
confidentiality: true
security_measures: true
subprocessor_approval: true
help_with_requests: true
help_with_breaches: true
delete_or_return: true
audits: true
breach_notice_hours: 48How to check
A script fails when a processor entry lacks any of the eight items marked true, or has no breach_notice_hours, or has a value above 72.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/processors-and-transfers/dpa-article-28.