{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2016-05-04","gaps":[],"covered":["GDPR L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":null,"checked_against":null},"truncation":{"shown":11,"total":11,"capped":false,"cap":1000,"next_cursor":null},"failures":[],"incomplete":[]},"page":{"path":"/gdpr/articles/28","url":"https://www.headlesslaw.com/gdpr/articles/28","title":"Article 28 — Processor","work_id":"gdpr","date_state":"current","as_of":"2026-11-02","relations_url":"https://www.headlesslaw.com/gdpr/articles/28/relations"},"as_of":"2026-11-02","counts":{"refers_to:out":5,"refers_to:in":3,"implements:in":2,"guides:in":1},"relations":[{"edge_id":"f68ea1427b9a22735c5f","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 93(2)","dst_raw":"eu.gdpr.article.93","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/93","url":"/gdpr/articles/93","title":"Committee procedure","key":"93","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.28","source_block_id":"eu.gdpr.article.28.paragraph.7"}},{"edge_id":"7bacc8232dbfd80a6740","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 32","dst_raw":"eu.gdpr.article.32","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/32","url":"/gdpr/articles/32","title":"Security of processing","key":"32","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.28","source_block_id":"eu.gdpr.article.28.paragraph.3.point.c"}},{"edge_id":"597fc6457cffadbd31bf","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 63","dst_raw":"eu.gdpr.article.63","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/63","url":"/gdpr/articles/63","title":"Consistency mechanism","key":"63","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.28","source_block_id":"eu.gdpr.article.28.paragraph.8"}},{"edge_id":"37b3410a8ac70870da4b","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 42","dst_raw":"eu.gdpr.article.42","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/42","url":"/gdpr/articles/42","title":"Certification","key":"42","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.28","source_block_id":"eu.gdpr.article.28.paragraph.5"}},{"edge_id":"3bd79cf1af8213f659a0","scope":"unit","type":"refers_to","direction":"out","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 40","dst_raw":"eu.gdpr.article.40","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/40","url":"/gdpr/articles/40","title":"Codes of conduct","key":"40","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.28","source_block_id":"eu.gdpr.article.28.paragraph.5"}},{"edge_id":"505e584aa0a888380b79","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 28(8)","dst_raw":"eu.gdpr.article.28","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/64/para/1/pt/d","url":"/gdpr/articles/64#p-1-d","title":"Opinion of the Board","key":"64(1)(d)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.64","source_block_id":"eu.gdpr.article.64.paragraph.1.point.d"}},{"edge_id":"9c5429d606bc3f080ccb","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 28(8)","dst_raw":"eu.gdpr.article.28","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/58/para/3/pt/g","url":"/gdpr/articles/58#p-3-g","title":"Powers","key":"58(3)(g)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.58","source_block_id":"eu.gdpr.article.58.paragraph.3.point.g"}},{"edge_id":"d1d6e64c26982f9f34e8","scope":"unit","type":"refers_to","direction":"in","resolution":"resolved","basis":"explicit_legal_cross_reference","method":"extracted_relationships","confidence":"medium","src_from":"2016-05-04","src_until":null,"span":"Article 28(8)","dst_raw":"eu.gdpr.article.28","other":{"work_id":"gdpr","level":"L1","locator":"gdpr/art/57/para/1/pt/j","url":"/gdpr/articles/57#p-1-j","title":"Tasks","key":"57(1)(j)","state_on_date":"in_force"},"evidence":{"object":"eu.gdpr.legal_text.article.57","source_block_id":"eu.gdpr.article.57.paragraph.1.point.j"}},{"edge_id":"b02ca04a75ca02c6e655","scope":"unit","type":"implements","direction":"in","resolution":"resolved","basis":"curated_edge_tsv","method":"bl21-edge-tsv","confidence":"curated","src_from":"2021-06-27","src_until":null,"span":null,"dst_raw":"eu.gdpr.article.28","other":{"work_id":"spaces/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries","level":"L2","locator":"spaces/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries/head","url":"/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries","title":"Decision — Standard contractual clauses for transfer to third countries [in force]","key":"2021/914","state_on_date":"in_force"},"evidence":{"tsv":"_research/coverage/bl21-l1-l2l3-edges.tsv","row":369,"evidence":"legal_basis: Article 28(7) and Article 46(2), point (c), GDPR | CELLAR 32021D0914: A28P7 A46P2PTC)","doc_type":"implementing_decision"}},{"edge_id":"ed22629fa040c6807ca9","scope":"unit","type":"implements","direction":"in","resolution":"resolved","basis":"curated_edge_tsv","method":"bl21-edge-tsv","confidence":"curated","src_from":"2021-06-27","src_until":null,"span":null,"dst_raw":"eu.gdpr.article.28","other":{"work_id":"spaces/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors","level":"L2","locator":"spaces/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/head","url":"/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors","title":"Decision — Contractual clauses between controllers and processors [in force]","key":"2021/915","state_on_date":"in_force"},"evidence":{"tsv":"_research/coverage/bl21-l1-l2l3-edges.tsv","row":370,"evidence":"legal_basis: Article 28(7) GDPR | CELLAR 32021D0915: A28P7 32018R1725:A29P7","doc_type":"implementing_decision"}},{"edge_id":"bbff23bbf85b3d8869ac","scope":"unit","type":"guides","direction":"in","resolution":"resolved","basis":"curated_edge_tsv","method":"bl21-edge-tsv","confidence":"curated","src_from":"2021-07-07","src_until":null,"span":null,"dst_raw":"eu.gdpr.article.28","other":{"work_id":"spaces/gdpr/level-3/guidelines/edpb-07-2020-controller-processor","level":"L3","locator":"spaces/gdpr/level-3/guidelines/edpb-07-2020-controller-processor/page","url":"/gdpr/level-3/guidelines/edpb-07-2020-controller-processor","title":"Guideline — Controller/processor [final]","key":"EDPB 07/2020","state_on_date":"in_force"},"evidence":{"tsv":"_research/coverage/bl21-l1-l2l3-edges.tsv","row":406,"evidence":"legal_basis: Articles 4(7), 4(8), 26, 28 and 29 GDPR","doc_type":"guideline"}}],"not_served":["exempts","derogates_from"],"note":"inverse edges are computed from the stored direction; floating targets are resolved on as_of (other.state_on_date)"}