Cyprus GDPR processor agreements: an Article 28 review guide

Determine the actual roles before choosing the document

Identify who decides the purposes and essential means of the relevant processing and who acts on that party’s behalf. The controller–processor description follows the actual arrangement, not merely the supplier’s preferred label. A provider may process customer records under instructions for one service while determining its own purposes for another activity. Describe those activities separately instead of forcing every relationship into one classification.

For a payroll service, establish which employer decides whose payroll is processed, why the information is used and the intended outputs. Then examine the provider’s operations and any separate uses it proposes. For example, a term permitting use of employee information for the provider’s own advertising raises a different question from calculating payroll under the employer’s instructions. Ask for that distinction before accepting a generic role statement.

If parties jointly determine purposes and means, assess joint controllership rather than using an Article 28 agreement to disguise the arrangement. If the recipient acts as an independent controller, a different analysis is needed. Document the role assessment in plain language so the commercial team understands why the chosen agreement applies to the specific activity and where its scope ends.

Basis and guidance: EDPB: controller and processor responsibilities

Define the service, people and information in scope

List the service functions that involve personal data: collection, storage, access, calculation, communication, support and deletion as appropriate. Identify the people concerned and the data categories actually supplied. “All customer data” is often too broad to explain the intended processing or to help the supplier limit access. Use descriptions that the operational team can connect to real systems and tasks.

Specify the duration and the processing purpose, including what happens during implementation, active service and termination. A supplier may receive data during a trial or migration before the paid subscription begins. Do not leave those stages outside the review merely because the commercial contract calls them onboarding. Establish which instructions and safeguards apply whenever the supplier begins handling the information.

Identify sensitive or unusual information explicitly where relevant, without copying actual personal records into the agreement. A schedule can describe categories and handling requirements without exposing a real employee’s health details or a customer’s identity document. Review whether each category is necessary for the service. Reducing unnecessary input is often a more effective operational improvement than adding another broad contractual promise.

Complete schedules that someone can implement

Article 28 arrangements cover more than a statement that both parties comply with GDPR. The processing description and the parties’ obligations must fit the actual service. The Commission publishes standard controller–processor clauses that can help structure the agreement, but their annexes and relevant choices still need completion. Preserve the agreed version and make clear which commercial documents form part of the arrangement.

Review the terms together with technical and service owners. A lawyer may identify an incomplete obligation, while the technical owner can explain whether the promised export, restriction or deletion process exists. Record unresolved points rather than letting each reviewer assume another person checked them. For an important operational promise, identify the evidence or demonstration that supports it.

Use the following review map to connect the agreement to an action or record. It is a practical review aid rather than a substitute contract. Where a row cannot be answered, ask a focused question and identify who must resolve it before the processing starts. Avoid filling every blank with “as required by law” when the parties still need to agree how the task will work.

Basis and guidance: EDPB: controller and processor responsibilities; European Commission: controller–processor standard clauses

Make instructions and security commitments specific

Identify the people authorised to issue instructions and the channel used to record them. A support request to repair a service is not necessarily permission to repurpose the underlying data. Make changes traceable so that the provider and the business can distinguish an approved instruction from a suggestion in an informal conversation. Ensure operational staff know when a request needs escalation.

Confidentiality is one part of the arrangement. Examine access management, staff responsibilities and the technical and organisational measures relevant to the processing. A security annex should explain the controls sufficiently to support the review, while avoiding unnecessary public disclosure of sensitive implementation details. Match the assurances to the actual product or environment being purchased, rather than a different service in the provider’s portfolio.

Ask how material control changes will be communicated and assessed. For example, a move from restricted support access to broader remote access changes the facts that informed the original review. Keep evidence of the configuration selected by the customer where protection depends on an optional setting. A contract cannot show that multi-factor authentication was enabled if nobody checked the tenant’s actual configuration.

Identify subprocessors and make authorisation meaningful

Article 28 requires prior specific or general written authorisation for engagement of another processor, with the relevant change information and opportunity to object under general authorisation. Review the chosen mechanism and the actual notification channel. A notice sent to an abandoned procurement inbox does not give the working team a useful chance to examine a proposed change before it affects the service.

The EDPB’s Opinion 22/2024 explains that controllers should have current identifying information about processors and subprocessors available, regardless of the processing risk. Verification of sufficient guarantees remains necessary, while its extent can vary with the circumstances and risk. Do not confuse having a list of company names with having assessed what those parties do and whether the proposed arrangements are adequate.

For each material subprocessor, connect its identity to its service function and relevant processing location or access arrangement. Ask the initial provider to resolve omissions or inconsistent descriptions. The review need not become an indiscriminate demand for every commercial document; request the information needed to understand the chain and support the controller’s assessment. Keep the decision and any conditions attached to authorisation visible.

Basis and guidance: EDPB: controller and processor responsibilities; EDPB Opinion 22/2024: processors and subprocessors

Test assistance for rights requests and security incidents

Check how the provider will help locate, export, restrict or delete relevant information when the controller handles an individual’s request. Establish contact points, identity-matching information and realistic response arrangements. A promise to “assist where possible” does not tell the team whether it can retrieve a particular record before the controller’s response is due. Test a safe example using fictional data.

For personal-data breaches, distinguish the processor’s duty to inform the controller without undue delay from the controller’s own authority-notification assessment. Agree a working escalation route, available information and subsequent updates. A process that waits for a final forensic report may leave the controller unable to make timely decisions. Identify a backup contact and how urgent reports are handled outside office hours.

Also examine assistance with security and impact assessments where relevant to the service. Ask for the information that the controller needs to understand processing risks and safeguards. Keep requests proportionate, but do not substitute a marketing security page for a factual answer about the system in use. Record who will provide follow-up when an assessment identifies a gap.

Prepare the operational escalation using the data-breach response guide.

For individual requests, use the access-request workflow.

Basis and guidance: EDPB: controller and processor responsibilities

Keep Article 28 terms and international transfers distinct

The Commission has separate standard clauses for controller–processor arrangements and for international transfers. Do not assume that attaching a document labelled “SCCs” answers both questions without examining which clauses and modules are used. The processing agreement and the transfer analysis must fit the roles, locations and access arrangements of the actual service.

Map hosting, support and onward processing rather than looking only at the supplier’s invoicing address. A provider established in the EEA may use personnel or subprocessors elsewhere. Establish whether the arrangement involves a relevant transfer and what mechanism and assessment are required. A sales statement that a product is “European” does not supply those facts or resolve the legal analysis.

If using Commission standard clauses, complete the applicable choices and annexes and avoid contradictory terms elsewhere in the contract. The Commission’s questions and answers explain the limits on modifying the standard text. Review additional commercial provisions for consistency, including arrangements that would undermine subprocessor authorisation or cooperation obligations. Do not describe altered wording as unchanged official clauses.

For the separate transfer assessment, see the international-transfer guide.

Basis and guidance: European Commission: controller–processor standard clauses; European Commission: standard-clause questions and answers

Design an exit that accounts for live data and backups

Article 28 includes return or deletion at the controller’s choice after the services end, subject to applicable legal storage requirements. Define how that choice will be communicated and carried out. Identify the export format, the person receiving it and the handling of remaining copies. A usable exit process matters before a dispute or urgent supplier change makes cooperation more difficult.

Clarify backup handling, access restrictions and the basis for any continued retention. In a hypothetical payroll arrangement, an immediate-deletion promise conflicts with a service description saying backups persist for several months. Ask for a coherent explanation of the lifecycle and applicable obligations. Do not silently reinterpret “immediate” or tell the business that all copies are gone when the provider has described an exception.

Test whether the exported information can actually be read and used for the intended handover. A download containing unlabelled fields may technically be an export but still leave the organisation unable to reconstruct its records. Agree the evidence that will demonstrate completion of return and deletion, and keep unresolved retained copies or legal restrictions explicitly recorded.

Coordinate the exit rules with the data-retention schedule.

Basis and guidance: EDPB: controller and processor responsibilities

Make compliance information and audit arrangements usable

The processor arrangements include providing information needed to demonstrate compliance and allowing and contributing to appropriate audits, including inspections. Review how those rights work in practice. Security reports and certifications can be relevant evidence, but check their scope, period and connection to the service. A certificate covering a different entity or product should not close a question about this processing.

Plan a proportionate review based on the information involved, service dependence and identified concerns. Ask focused follow-up where evidence is incomplete or inconsistent. An audit provision should support verification rather than become a clause nobody can operationalise. Assign responsibility for reading the reports received and tracking any issues that affect the organisation’s use of the provider.

Keep the evidence current at appropriate review points and when material changes occur. A provider assessment completed before a major acquisition, new subprocessor or changed data use may no longer describe the present arrangement. Record which changes trigger reassessment and who receives the notice. The purpose is an informed continuing decision, not an annually renewed checkbox that nobody examines.

Basis and guidance: EDPB: controller and processor responsibilities; EDPB Opinion 22/2024: processors and subprocessors

Run a practical review before approval and keep ownership clear

Before approval, ask the service owner to walk through a rights request, a suspected breach and termination. Identify which contractual contact, procedure and capability would be used in each case. Note any answer that depends on an undocumented assumption. This short exercise often exposes a missing schedule or an unusable contact route more clearly than another general declaration of compliance.

Maintain an exceptions log with the issue, the evidence needed, the responsible person and the decision. Distinguish a resolved concern from a commercially accepted limitation that still requires a lawful and workable processing arrangement. A supplier’s refusal to negotiate does not remove the controller’s obligations. Escalate material gaps before sending personal data or expanding the service.

Preserve the agreed contract, completed annexes, role assessment and supporting review together. Assign ongoing ownership to someone who will see service changes, rather than leaving the file solely with the person who signed the order. Zeno can coordinate independent professional support for the review; the final arrangement should reflect the real processing and the organisation’s ability to carry out its responsibilities.

Primary sources and scope

Sources checked: September 27, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.

• EDPB: controller and processor responsibilities
• European Commission: controller–processor standard clauses
• European Commission: standard-clause questions and answers
• EDPB Opinion 22/2024: processors and subprocessors

Practical guides for this topic

• Cyprus GDPR joint-controller arrangements: Article 26

  Assess joint controllership and build an Article 26 arrangement for a Cyprus collaboration, with clear duties, rights, breach handling and notices.