Chapter 4

Controller and Processor

Articles 24-43

This chapter establishes the obligations and responsibilities of data controllers and processors. It introduces key accountability measures including data protection by design and by default, records of processing activities, data protection impact assessments, security requirements, breach notification obligations, and the role of Data Protection Officers. This chapter forms the operational core of GDPR compliance for organizations.

Overview

Chapter IV: Controller and Processor

Chapter IV establishes the comprehensive framework of responsibilities and obligations for organizations that process personal data. It translates the principles from Chapter II into concrete operational requirements and accountability measures.

Controller Responsibilities (Articles 24-31):

General Responsibility (Article 24): Controllers must implement appropriate technical and organizational measures to ensure and demonstrate GDPR compliance, taking into account the nature, scope, context, and purposes of processing.
Data Protection by Design and by Default (Article 25): Controllers must integrate data protection into processing activities from the design stage and ensure that, by default, only necessary personal data is processed.
Joint Controllers (Article 26): When two or more controllers jointly determine purposes and means of processing, they must transparently determine their respective responsibilities through an arrangement.
EU Representatives (Article 27): Controllers or processors not established in the EU but subject to GDPR must designate a representative in the EU.
Records of Processing Activities (Article 30): Controllers and processors must maintain detailed written records of processing activities, including purposes, categories of data and recipients, transfers, retention periods, and security measures.
Cooperation with Supervisory Authorities (Article 31): Controllers and processors must cooperate with supervisory authorities upon request.

Processor Obligations (Articles 28-29):

Processors may only process personal data on documented instructions from the controller. A written contract must govern the processor relationship, specifying the subject matter, duration, nature, and purpose of processing, as well as the processor's obligations regarding security, sub-processing, assistance with data subject rights, and breach notification. Processors must maintain records of processing activities carried out on behalf of controllers.

Security and Breach Management (Articles 32-34):

Security of Processing (Article 32): Controllers and processors must implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including pseudonymization, encryption, confidentiality, integrity, availability, and resilience of systems.
Breach Notification to Authority (Article 33): Controllers must notify the supervisory authority of a personal data breach within 72 hours of becoming aware, unless unlikely to result in risk to rights and freedoms.
Breach Communication to Data Subjects (Article 34): When a breach is likely to result in high risk to rights and freedoms, controllers must communicate the breach to affected data subjects without undue delay.

Data Protection Impact Assessment (Articles 35-36):

Controllers must conduct a DPIA before processing that is likely to result in high risk to rights and freedoms, particularly when using new technologies, systematic monitoring, large-scale processing of special categories of data, or automated decision-making. If a DPIA indicates high risk that cannot be mitigated, the controller must consult the supervisory authority before processing.

Data Protection Officer (Articles 37-39):

Controllers and processors must designate a DPO when processing is carried out by a public authority, core activities require regular and systematic monitoring on a large scale, or core activities consist of large-scale processing of special categories of data or criminal convictions data. The DPO must be independent, have expert knowledge, and be involved in all data protection matters.

Codes of Conduct and Certification (Articles 40-43):

The GDPR encourages the development of codes of conduct and certification mechanisms as tools to demonstrate compliance. These voluntary frameworks can help organizations, particularly SMEs, meet their GDPR obligations and provide transparency to data subjects.

Articles in This Chapter

Article 24: Responsibility of the controller

Controllers must implement appropriate technical and organizational measures to ensure and demonstrate GDPR compliance, taking into account processing risks. This establishes the accountability principle.
Article 25: Data protection by design and by default

Controllers must implement data protection principles from the design stage of systems and ensure that by default, only necessary personal data is processed. Privacy must be built-in, not bolted-on.
Article 26: Joint controllers

Establishes requirements when two or more controllers jointly determine processing purposes and means, including transparent arrangements and data subject rights.
Article 27: Representatives of controllers or processors not established in the Union

Requires non-EU controllers/processors subject to GDPR to designate EU representatives for supervisory authority and data subject contact.
Article 28: Processor

Controllers must only use processors providing sufficient guarantees. Processing must be governed by a contract or legal act setting out specific obligations, including processing only on instructions, ensuring security, and assisting with data subject rights.
Article 29: Processing under the authority of the controller and processor

Processors and any persons acting under their authority must process personal data only on controller instructions, unless required by law.
Article 30: Records of processing activities

Controllers and processors must maintain written records of processing activities, including purposes, categories, security measures, and transfers. Small enterprises (<250 employees) have limited exemptions.
Article 31: Cooperation with the supervisory authority

Requires controllers, processors, and their representatives to cooperate with supervisory authorities in performing their tasks.
Article 32: Security of processing

Requires controllers and processors to implement appropriate technical and organizational security measures based on processing risks.
Article 33: Notification of a personal data breach to the supervisory authority

Requires controllers to notify supervisory authorities of personal data breaches within 72 hours unless the breach is unlikely to risk individuals' rights.
Article 34: Communication of a personal data breach to the data subject

When a breach is likely to result in high risk to individuals' rights and freedoms, controllers must communicate the breach to affected data subjects without undue delay, unless certain exceptions apply.
Article 35: Data protection impact assessment

Controllers must conduct a Data Protection Impact Assessment (DPIA) before high-risk processing, particularly for systematic evaluation, large-scale special category data processing, or systematic public area monitoring.
Article 36: Prior consultation

Requires controllers to consult supervisory authorities before processing that would result in high risk despite mitigation measures following a DPIA.
Article 37: Designation of the data protection officer

Organizations must appoint a DPO if they are public authorities, conduct large-scale systematic monitoring, or process large-scale special category or criminal data. DPO contact details must be published.
Article 38: Position of the data protection officer

The DPO must be properly involved in all data protection matters, provided necessary resources, report to highest management, operate independently without instructions, and be protected from dismissal or penalty for performing duties.
Article 39: Tasks of the data protection officer

The DPO's tasks include: informing and advising on GDPR obligations, monitoring compliance, providing DPIA advice, cooperating with supervisory authority, and serving as contact point.
Article 40: Codes of conduct

Industry associations can develop codes of conduct to specify GDPR application. Codes must be approved by supervisory authorities and can demonstrate compliance. They should include monitoring mechanisms.
Article 41: Monitoring of approved codes of conduct

Establishes the framework for independent monitoring bodies to oversee compliance with approved codes of conduct, including accreditation requirements and enforcement powers.
Article 42: Certification

Establishes voluntary data protection certification mechanisms, seals, and marks to demonstrate GDPR compliance, with special consideration for SMEs and provisions for international transfers.
Article 43: Certification bodies

Defines requirements for certification bodies that issue and renew data protection certifications, including accreditation procedures, competence standards, and supervisory oversight.