Article 28 GDPR General Data Protection Regulation: Compliance Guide

Introduction

*Updated for 2026 compliance practices.*

Understanding **article 28 gdpr general data protection regulation** is essential for any website owner who uses third-party services to process personal data. If your site integrates analytics, advertising pixels, or cloud-hosted consent management platforms, you are likely acting as a data controller engaging a data processor. Article 28 of the General Data Protection Regulation (GDPR) sets out the legal obligations that govern this relationship. For website operators, this translates into concrete technical and contractual steps that must be in place before a single cookie is dropped or a tracking request is fired.

This guide focuses on the practical, verifiable actions you can take to align your website with Article 28 requirements. We will cover what the regulation demands, how to implement it step by step, common pitfalls, and how to use GDPRChecker’s scanning tools to validate your setup. While this article provides technical implementation guidance, it does not constitute legal advice. Always consult a qualified privacy professional for your specific situation.

Requirements and Compliance Expectations

Meeting **article 28 gdpr general data protection regulation** requirements involves more than signing a DPA. The regulation expects controllers to use only processors that provide “sufficient guarantees” to implement appropriate technical and organizational measures. For a website, this means you must evaluate each third-party service before integration. Key compliance expectations include:

**Contractual Documentation**: A signed or electronically accepted DPA with every processor.
**Instruction Control**: You must be able to instruct the processor on what data to collect and for what purpose. This is often managed through configuration settings in the service’s dashboard.
**Sub-processor Transparency**: The processor must inform you of any sub-processors they engage, and you must have the right to object.
**Security Measures**: The processor must implement measures like encryption, pseudonymization, and access controls.
**Data Breach Notification**: The processor must notify you without undue delay after becoming aware of a personal data breach.
**Deletion or Return of Data**: At your choice, the processor must delete or return all personal data after the service ends.

From a technical standpoint, you must also ensure that your website’s configuration respects these contractual boundaries. For example, if your DPA with an analytics provider states that data will only be processed for aggregated reporting, you must not enable features that allow the provider to use the data for their own purposes, such as remarketing or benchmarking, unless explicitly covered by the agreement.

How to Implement Article 28 Step by Step

Implementing Article 28 on your website is a multi-stage process that combines legal, administrative, and technical actions. Below is a practical workflow:

**Inventory Your Processors**: List every third-party service that receives personal data from your website. This includes analytics (Google Analytics, Matomo), advertising pixels (Meta, LinkedIn), CMPs, CDNs, hosting providers, and even embedded video players if they set cookies or collect IP addresses.
**Obtain and Review DPAs**: For each processor, locate their standard DPA. Most major providers publish these on their websites. Review the terms to ensure they align with your processing purposes. Pay special attention to clauses on sub-processors and international data transfers.
**Document Instructions**: In many cases, the DPA will reference the controller’s instructions as set out in the main service agreement or through configuration settings. Keep a record of how you have configured each service to reflect your instructions (e.g., IP anonymization enabled, advertising features disabled).
**Configure Consent Management**: Your consent management platform must be configured to block all non-essential processor scripts until the user has given valid consent. This is where **article 28 gdpr general data protection regulation** intersects with consent requirements. Without proper consent, any data processing by those scripts may be unlawful, regardless of the DPA.
**Implement Technical Safeguards**: Use tag management systems to enforce conditional loading of processor scripts based on consent state. For Google services, implement Consent Mode v2 to adjust tag behavior based on user choices. This ensures that even if a script loads, it does not process personal data without consent.
**Maintain Records**: Keep a central repository of all DPAs, configuration screenshots, and consent logs. Under Article 30 of the GDPR, controllers must maintain records of processing activities, which includes information about processors.

Common Mistakes and How to Avoid Them

Many website owners inadvertently fall short of Article 28 compliance due to oversights that are easy to fix once identified. Here are the most frequent mistakes and practical remedies:

**Assuming a DPA Exists**: Embedding a third-party service without checking for a DPA is a critical error. Always verify that a DPA is in place before going live. If a provider does not offer one, you should not use their service for personal data processing.
**Ignoring Sub-processors**: A processor may use sub-processors (e.g., a cloud infrastructure provider). Your DPA should list them, and you should have the opportunity to object. Regularly check for updates to the sub-processor list.
**Misconfigured Consent Banners**: A common technical mistake is a consent banner that does not actually block processor scripts before consent. For example, if your Google Analytics tag fires on page load regardless of consent, you are processing data without a lawful basis. Use a scanner to verify that no network requests to processor domains occur before consent.
**Incomplete Instruction Records**: Failing to document your configuration choices can leave you unable to demonstrate compliance. Keep dated records of your settings for each processor.
**Overlooking Embedded Content**: Embedded YouTube videos, social media feeds, or third-party fonts can act as data processors. Each must be covered by a DPA or, if that is not feasible, loaded only after explicit consent.
**Neglecting Post-Change Verification**: After updating a processor’s configuration or your consent banner, always re-scan your site. Even minor changes can inadvertently enable data flows that violate your DPA terms.

How to Validate with GDPRChecker

GDPRChecker provides a practical way to verify that your website’s technical implementation aligns with your Article 28 obligations. While GDPRChecker does not review legal contracts, it scans your site for the behavioral evidence that a processor relationship is properly managed. Here is how to use it:

**Pre-Consent Request Scan**: Run a scan to see which network requests are made before any user interaction with your consent banner. Any request to a processor domain that occurs before consent is a red flag. GDPRChecker will list these requests, allowing you to identify scripts that need to be blocked or configured with Consent Mode.
**Consent Banner Behavior Check**: Verify that your banner correctly categorizes cookies and trackers, and that the “Reject All” option effectively stops non-essential processing. The scanner can simulate a rejection and confirm that no subsequent processor requests are fired.
**Policy Link Verification**: Ensure that your privacy policy and cookie policy are accessible and contain the required disclosures about processors. GDPRChecker checks for the presence of policy links and can flag missing or broken links.
**Ongoing Monitoring**: On paid plans, GDPRChecker offers runtime protection and monitoring that continuously checks for new or unauthorized processor requests. This is crucial because third-party scripts can change over time, introducing new sub-processors without your knowledge.

For a deeper dive into related topics, see our guides on cookie banner requirements and privacy policy requirements.

Implementation Checklist

Use this checklist to ensure you have addressed the key technical and administrative steps for Article 28 compliance:

List all third-party services that process personal data on your website.
Obtain and store a signed or accepted DPA for each processor.
Review each DPA for sub-processor disclosures and international transfer safeguards.
Document your specific instructions for each processor (e.g., IP anonymization, data sharing settings).
Configure your consent management platform to block all non-essential processor scripts by default.
Implement Google Consent Mode v2 for Google services to respect consent signals.
Test your consent banner’s “Reject All” flow to confirm no processor requests fire.
Scan your site with GDPRChecker to identify any pre-consent network requests to processor domains.
Verify that your privacy policy lists all processors and links to their respective privacy notices.
Set a recurring calendar reminder to review processor configurations and DPA updates quarterly.
Keep a change log of any modifications to processor settings or consent banner configurations.
Re-scan your website after any plugin updates, tag changes, or new service integrations.

Real-World Examples

**Example 1: Google Analytics without a DPA** A small e-commerce site installs Google Analytics via a plugin. The owner assumes that because Google’s terms of service mention GDPR, they are covered. However, they never actively accepted the Google Ads Data Processing Terms, which serve as the DPA. In an audit, they cannot produce a signed agreement. Solution: Accept the DPA in the Google Analytics admin panel and document the acceptance date.

**Example 2: Consent Banner Bypass** A news website uses a popular CMP that displays a cookie banner. However, their developer hard-coded the Facebook Pixel to fire on every page load for conversion tracking. A GDPRChecker scan reveals that the pixel fires before any consent is given. This means personal data is being processed without a lawful basis, and the DPA with Meta is effectively undermined. Solution: Integrate the pixel through a tag manager that respects consent signals, or implement Consent Mode for the pixel.

**Example 3: Embedded YouTube Videos** A blog embeds YouTube videos using the standard iframe code. When a user visits a page with an embedded video, YouTube sets cookies and collects the user’s IP address even if the video is not played. The blog owner has no DPA with YouTube and has not configured the embed to load only after consent. Solution: Use a privacy-enhanced embed method (such as youtube-nocookie.com) and wrap the iframe in a consent-conditional placeholder.

For more on configuring analytics in a compliant way, read our guide on Google Analytics GDPR compliance.

FAQ

What is article 28 gdpr general data protection regulation? Article 28 of the GDPR requires a written contract between a data controller and a data processor. For website owners, this means you must have a Data Processing Agreement (DPA) with every third-party service that handles personal data on your behalf, such as analytics or advertising providers.

Do I need article 28 gdpr general data protection regulation for GDPR? Yes, if your website uses any external service to process personal data, you are acting as a controller and must comply with Article 28. This applies even if you are a small business or a personal blog using free tools like Google Analytics.

How do I implement article 28 gdpr general data protection regulation? Start by inventorying all third-party services that receive personal data from your site. Obtain and review their DPAs, document your processing instructions, configure your consent banner to block non-essential scripts, and verify with a scanner that no unauthorized data flows occur.

How can I verify article 28 gdpr general data protection regulation with a scanner? Use GDPRChecker to scan your website for pre-consent network requests to processor domains. The scanner will identify any scripts that fire before user consent, which indicates a potential violation of your DPA terms and consent requirements.

What are common article 28 gdpr general data protection regulation mistakes? Common mistakes include failing to obtain a DPA, ignoring sub-processor disclosures, misconfiguring consent banners so that processor scripts load before consent, and not documenting your configuration instructions. Regular scanning and record-keeping can prevent these issues.

Which cookies and trackers should I check for article 28 gdpr general data protection regulation? You should check all cookies and trackers set by third-party services that process personal data. This includes analytics cookies, advertising pixels, social media widgets, and any other tracker that sends data to an external domain. GDPRChecker can automatically categorize these for you.

How often should I review article 28 gdpr general data protection regulation? Review your processor relationships and DPAs at least quarterly, or whenever you add a new service, update a plugin, or change your consent configuration. Many processors update their sub-processor lists periodically, so regular checks are essential.

What evidence should I keep for article 28 gdpr general data protection regulation? Keep signed or accepted DPAs, records of your configuration settings for each processor, consent logs from your CMP, and scan reports from GDPRChecker. This evidence demonstrates your compliance efforts to regulators and data subjects.

Next Steps

Achieving **article 28 gdpr general data protection regulation** compliance is an ongoing process that requires both contractual diligence and technical verification. Start by scanning your website with GDPRChecker to uncover any hidden data flows to processors. Then, systematically work through the checklist above to close any gaps. For a broader compliance overview, explore our GDPR checklist for small businesses. If you use Google services, our guides on Google Consent Mode v2 and the Google Consent Mode v2 checker provide detailed configuration steps.

Ready to validate your site? Run a free scan with GDPRChecker today and get a clear picture of your processor data flows.

Next step

Run a GDPRChecker scan to validate consent behavior, trackers, and disclosures after you implement the checklist above.

Practical examples

Example 1: A small ecommerce site

A shop changes its cookie banner wording before a seasonal campaign. The operator records the previous and new banner version, tests Reject all and Accept all, and stores screenshots plus the resulting network checks. That creates a clear before-and-after record without relying on memory.

Example 2: A B2B lead-generation site

A marketing team adds a form analytics tag through its tag manager. Before publishing, it documents the consent category, the tag trigger, the privacy notice update, and a test showing that the request does not fire after a visitor rejects optional cookies.

Example 3: A multi-page content site

An editor notices that a new embedded video adds a third-party request. The team scans the affected pages, compares the result with the last scan, updates the cookie disclosure if necessary, and keeps the scan report with the deployment reference.

> This guide is technical implementation guidance for website owners. It is not legal advice.

Article schema

```json { "@context": "https://schema.org", "@type": "Article", "headline": "Article 28 GDPR: A Practical Guide for Website Owners", "description": "Learn what Article 28 GDPR means for website owners. Step-by-step implementation, common mistakes, and how to validate compliance with GDPRChecker's scanner.", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.gdprchecker.online/guides/article-28-gdpr-general-data-protection-regulation" }, "publisher": { "@type": "Organization", "name": "GDPRChecker", "url": "https://www.gdprchecker.online" } } ```

Copyright and editorial notice

This original AI-assisted editorial draft was selected, reviewed, and published by GDPRChecker. All rights are reserved where protected by applicable law. Do not reproduce the article without permission.