In short. GDPR Article 28 requires a written, binding processor agreement covering the processing, mandatory provider duties and subprocessor authorisation.
Definition: An analytics processor contract is a binding agreement governing an analytics provider's processing of personal data on a website operator's behalf. Article 28 of the General Data Protection Regulation (GDPR) requires it to describe the processing, impose specified duties on the provider and control the use of subprocessors.
Key facts
- The GDPR on EUR-Lex, Article 28(3) and (9), requires a binding contract or other qualifying legal act in writing, including electronic form.
- Paragraph 112 of the European Data Protection Board's Guidelines 07/2020 calls for concrete implementation details in the agreement.
- The Commission's Decision (EU) 2021/915 supplies standard controller-processor clauses with annexes for the processing description and technical and organisational measures.
When does an analytics provider act as a processor?
The GDPR, Article 4(7) and (8), defines a controller as the party determining the purposes and means of personal data processing, and a processor as the party processing personal data on that controller's behalf. The contract requirement applies when an analytics provider performs that processor role. Article 28(10) treats a processor that determines the purposes and means as a controller for that processing.
Article 28(3) requires the agreement to specify the subject matter, duration, nature and purpose of processing, the personal data types, the categories of people concerned, and the controller's rights and obligations. The EDPB guidance, paragraph 114, says the duration can be an exact period or criteria for determining it; a data description consisting only of a reference to the GDPR's definition of personal data is inadequate.
Which duties must the contract contain?
Under GDPR Article 28(3), the contract must require the processor to:
- Follow documented controller instructions, including for international transfers. Where Union or Member State law requires processing, inform the controller beforehand unless that law prohibits disclosure on important public interest grounds.
- Ensure authorised personnel are bound by confidentiality and take the security measures required by Article 32.
- Respect the subprocessor conditions in Article 28(2) and (4).
- Assist with individuals' rights requests through appropriate technical and organisational measures, insofar as possible given the processing's nature.
- Assist with the obligations in Articles 32 to 36, covering security, breach notifications, impact assessments and prior consultation, taking account of the processing's nature and available information.
- Return or delete all personal data after processing services end, at the controller's choice, and delete copies unless Union or Member State law requires storage.
- Provide compliance information and permit and contribute to audits, including inspections by the controller or its appointed auditor.
The same article also requires the processor to inform the controller immediately if it considers an instruction unlawful under the GDPR or other Union or Member State data protection provisions.
What conditions apply to subprocessors?
A subprocessor is another processor engaged to carry out processing on the controller's behalf. GDPR Article 28(2) and (4) requires prior specific or general written authorisation. With general authorisation, the provider must notify intended additions or replacements and give the controller an opportunity to object. The subprocessor must be bound by the same data protection obligations; the initial processor remains fully liable to the controller for the subprocessor's performance.
The EDPB guidance, paragraphs 128 and 158, recommends specifying the notification process, approval or objection timeframe, communication method and practical consequences of an objection. Changes must be actively flagged to the controller. Paragraph 155 treats an unanswered request for specific authorisation as denied; paragraph 157 allows silence within the agreed general-authorisation process to be interpreted as authorisation.
How can a website check the contract's supporting schedules?
As of 17 October 2026, the Commission's standard clauses in Decision (EU) 2021/915 provide a review structure. Annex II records the processing description and duration. Annex III requires concrete security measures and measures supporting assistance to the controller. Annex IV records authorised subprocessors when the specific-authorisation option is used. Clause 7.7 sets out alternative authorisation procedures with a notice period to be completed by the parties.
Related terms
- What does GDPR Article 25 require of website privacy defaults?
- How does GDPR Article 32 apply to website security?
- What safeguards can support analytics data transfers outside the EEA?
FAQ
Can you use an electronic agreement?
Yes. GDPR Article 28(9) expressly permits electronic form.
Do the Commission's processor clauses cover international transfers by themselves?
The Commission clauses, Clause 1(f), state that they do not by themselves ensure compliance with the GDPR's international transfer obligations under Chapter V.
Sources
- EUR-Lex, "Regulation (EU) 2016/679 (General Data Protection Regulation)", 27 April 2016
- European Data Protection Board, "Guidelines 07/2020 on the concepts of controller and processor in the GDPR", adopted 7 July 2021, corrected 20 September 2022
- EUR-Lex, "Commission Implementing Decision (EU) 2021/915", 4 June 2021
Check how a page reads to answer engines. Open the GEO score analyzer