{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/agent/gdpr-2016-679/artikel-28",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-08-25",
    "proof": "sha256:950003125bb416d6976f7c181736181b6983e50e05c66273027bfaa88bc77e05",
    "jurisdiction": "eu"
  },
  "id": "gdpr-2016-679-28",
  "script": {
    "kind": "operative",
    "fields": [
      {
        "name": "processor_used",
        "kind": "boolean",
        "label": "Ett personuppgiftsbiträde anlitas",
        "labelEn": "A processor is engaged"
      },
      {
        "name": "written_contract",
        "kind": "boolean",
        "label": "Skriftligt avtal finns",
        "labelEn": "A written contract is in place"
      },
      {
        "name": "subprocessor_authorised",
        "kind": "boolean",
        "label": "Underbiträden är godkända",
        "labelEn": "Sub-processors are authorised"
      }
    ],
    "rules": [
      {
        "id": "28-none",
        "when": {
          "op": "equals",
          "field": "processor_used",
          "value": false
        },
        "outcome": {
          "code": "outside",
          "title": "Artikel 28 är inte tillämplig",
          "titleEn": "Article 28 does not apply",
          "obligation": "Inget biträde anlitas.",
          "obligationEn": "No processor is engaged.",
          "refs": [
            "1"
          ]
        }
      },
      {
        "id": "28-no-contract",
        "when": {
          "op": "not",
          "of": {
            "op": "equals",
            "field": "written_contract",
            "value": true
          }
        },
        "outcome": {
          "code": "contract-missing",
          "title": "Biträdesavtal saknas",
          "titleEn": "The processing contract is missing",
          "obligation": "Behandlingen ska regleras i ett avtal med det innehåll som anges i artikel 28.3 a till h.",
          "obligationEn": "The processing shall be governed by a contract with the content set out in Article 28(3)(a) to (h).",
          "refs": [
            "3"
          ]
        }
      },
      {
        "id": "28-subprocessor",
        "when": {
          "op": "equals",
          "field": "subprocessor_authorised",
          "value": false
        },
        "outcome": {
          "code": "subprocessor-unauthorised",
          "title": "Underbiträde utan godkännande",
          "titleEn": "Sub-processor without authorisation",
          "obligation": "Ett biträde får inte anlita ett underbiträde utan skriftligt förhandsgodkännande, särskilt eller allmänt, från den ansvarige.",
          "obligationEn": "A processor shall not engage a sub-processor without prior specific or general written authorisation from the controller.",
          "refs": [
            "2"
          ]
        }
      },
      {
        "id": "28-ok",
        "when": {
          "op": "equals",
          "field": "written_contract",
          "value": true
        },
        "outcome": {
          "code": "contract-in-place",
          "title": "Avtalet finns",
          "titleEn": "The contract is in place",
          "obligation": "Avtalet ska ålägga biträdet tystnadsplikt, säkerhet enligt artikel 32, bistånd och radering eller återlämnande vid uppdragets slut.",
          "obligationEn": "The contract shall bind the processor to confidentiality, security under Article 32, assistance and deletion or return at the end of the engagement.",
          "refs": [
            "3"
          ]
        }
      }
    ],
    "fallback": {
      "code": "abstain",
      "title": "Artikeln ger inget utfall på den indata som lämnats",
      "titleEn": "The article yields no outcome for the facts supplied",
      "obligation": "Ingen av artikelns rekvisit är uppfyllda med de uppgifter som lämnats. Lämna fler uppgifter eller läs artikeltexten i sin helhet.",
      "obligationEn": "None of the article's conditions are met with the facts supplied. Supply more facts or read the article in full.",
      "refs": []
    }
  },
  "hash": "sha256:950003125bb416d6976f7c181736181b6983e50e05c66273027bfaa88bc77e05",
  "version": "legal-2026-08-25",
  "expires": "2026-08-31T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-08-25+legal-2026-08-25+2026-08-25T10:00:00",
    "content_hash": "sha256:950003125bb416d6976f7c181736181b6983e50e05c66273027bfaa88bc77e05",
    "revalidate_after": "2026-08-30T08:07:09.553Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; live-fetch-per-answer; attribution-required; no-derived-index",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/agent/gdpr-2016-679/artikel-28",
  "disclaimer": "Källhänvisning med officiell identifierare. Ingen juridisk rådgivning och inget efterlevnadsbeslut.",
  "usageInfo": "https://legal.exploreworldai.com/citering"
}