Processor — EU recitals
What the recitals mean for the role of processor: the obligations, the articles carrying them, the workflows that get you there and what most often fails. Every row carries article, reading date and hash.
Share this page
Obligations
- GDPR — 28: Processor — Process only on documented instructions under a written contract.
- GDPR — 32: Security of processing — Ensure a level of security appropriate to the risk.
- GDPR — 33: Notification of a personal data breach to the supervisory authority — Notify the controller without undue delay after becoming aware of a breach.
Risk points
- Sub-processors are added without updating the contract and the register.
What forces a redo
- The node hash changes — the text behind the row is no longer the same.
- The reading date moves forward — the row has been re-read against the source.
- A timeline passes — the requirement starts to apply or tightens.
As data
- The same node as data: add ?format=json to the address, or ?format=agent for receipt and dependencies.
Workflows
Articles
Relations
Metadata
- Acts
- GDPR
- Articles
- 3
- Reading date
- 2026-08-31
- Freshness
- 74/100
- Hash
- b14753a4686addb0
- Corpus version
- legal-2026-08-25
- Next check
- —
Next step
Three ways to put the register to work in your own practice.
Start with your task
Litigation
Find support in a judgment
Search guiding decisions, see what became final and follow changes in the law.
In-house, deals
Map the rules in a transaction
Move from theme to act and on to the article that carries the duty.
Compliance
Assess the risk in a process
Risk scoring per legal area, with the sources behind every score.