> For the complete documentation index, see [llms.txt](https://www.headlesslaw.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.headlesslaw.com/gdpr/chapters/iv.md).

# Chapter IV — Controller and processor

Articles 24–43 of Regulation (EU) 2016/679 (GDPR).

### Section 1 — General obligations

* [Article 24 — Responsibility of the controller](/gdpr/articles/24.md)
* [Article 25 — Data protection by design and by default](/gdpr/articles/25.md)
* [Article 26 — Joint controllers](/gdpr/articles/26.md)
* [Article 27 — Representatives of controllers or processors not established in the Union](/gdpr/articles/27.md)
* [Article 28 — Processor](/gdpr/articles/28.md)
* [Article 29 — Processing under the authority of the controller or processor](/gdpr/articles/29.md)
* [Article 30 — Records of processing activities](/gdpr/articles/30.md)
* [Article 31 — Cooperation with the supervisory authority](/gdpr/articles/31.md)

### Section 2 — Security of personal data

* [Article 32 — Security of processing](/gdpr/articles/32.md)
* [Article 33 — Notification of a personal data breach to the supervisory authority](/gdpr/articles/33.md)
* [Article 34 — Communication of a personal data breach to the data subject](/gdpr/articles/34.md)

### Section 3 — Data protection impact assessment and prior consultation

* [Article 35 — Data protection impact assessment](/gdpr/articles/35.md)
* [Article 36 — Prior consultation](/gdpr/articles/36.md)

### Section 4 — Data protection officer

* [Article 37 — Designation of the data protection officer](/gdpr/articles/37.md)
* [Article 38 — Position of the data protection officer](/gdpr/articles/38.md)
* [Article 39 — Tasks of the data protection officer](/gdpr/articles/39.md)

### Section 5 — Codes of conduct and certification

* [Article 40 — Codes of conduct](/gdpr/articles/40.md)
* [Article 41 — Monitoring of approved codes of conduct](/gdpr/articles/41.md)
* [Article 42 — Certification](/gdpr/articles/42.md)
* [Article 43 — Certification bodies](/gdpr/articles/43.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://www.headlesslaw.com/gdpr/chapters/iv.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.