## Pre-review source sufficiency The stated requirement basis is **EU GDPR Article 28(2) and Article 28(3)**. I verified the supplied authority basis against the official Eur-Lex text. Article 28(2) addresses prior specific/general written authorization for subprocessors and, for general authorization, notice of intended additions/replacements with an opportunity to object. Article 28(3) contains the contractual content requirements and processor obligations covering instructions, confidentiality, security, subprocessors, assistance, end-of-service handling, and audits. The contractual source set is described as complete, but the prompt provides a **summary of the DPA's key provisions rather than the full text of the DPA and Schedules 1–2**. Accordingly, I can assess the contractual obligations expressly identified in the supplied material, but I will not treat requirements not visible in those supplied provisions as definitively absent. ### Clause-to-Requirement Coverage Matrix | Requirement ID | Requirement | Requirement Source | Contract Document | Clause / Location | Contract Evidence | Coverage Status | Reason / Mapping Analysis | Evidence Limitation | Human Review | | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------- | ----------------- | ----------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | | R28-02-01 | Processor must not engage another processor without the Controller's prior specific or general written authorization. | GDPR Art. 28(2) | DPA | Clause 5 — Sub-processors | Processor may appoint sub-processors only with Controller's prior written authorisation. | **PRESENT** | Clause 5 directly addresses prior written authorization before appointment of sub-processors. | The supplied wording does not specify whether authorization is specific or general. | **Required** if the legal significance of that distinction must be assessed. | | R28-02-02 | Where authorization is general, Processor must inform Controller of intended additions/replacements and give Controller an opportunity to object. | GDPR Art. 28(2) | DPA | Clause 5 — Sub-processors | Processor must notify Controller of intended changes. | **AMBIGUOUS** | Notification of intended changes is expressly covered, but the supplied clause summary does not expressly state an opportunity for Controller to object, nor whether the authorization mechanism is general. | Full Clause 5 text is not supplied. | **Required** | | R28-03-01 | Contract must set out the subject matter and duration of the processing. | GDPR Art. 28(3) first sentence | DPA | Not identified in supplied key provisions | No corresponding provision is identified in the supplied clause summary. | **UNSUPPORTED** | The available contract summary does not provide evidence sufficient to determine coverage of this contract-content requirement. | Other DPA provisions may contain the information, but their contents are not supplied. | **Required** | | R28-03-02 | Contract must set out the nature and purpose of the processing. | GDPR Art. 28(3) first sentence | DPA | Not identified in supplied key provisions | No corresponding provision is identified in the supplied clause summary. | **UNSUPPORTED** | No supplied contractual evidence permits a reliable coverage determination. | Full DPA text is unavailable in the supplied evidence. | **Required** | | R28-03-03 | Contract must set out the type of personal data. | GDPR Art. 28(3) first sentence | DPA | Not identified in supplied key provisions | No corresponding provision is identified in the supplied clause summary. | **UNSUPPORTED** | The supplied provisions do not identify the categories/types of personal data processed. | Full DPA/Schedule text is not provided. | **Required** | | R28-03-04 | Contract must set out the categories of data subjects. | GDPR Art. 28(3) first sentence | DPA | Not identified in supplied key provisions | No corresponding provision is identified in the supplied clause summary. | **UNSUPPORTED** | No supplied evidence identifies the relevant categories of data subjects. | Full DPA/Schedule text is not provided. | **Required** | | R28-03-05 | Contract must set out the obligations and rights of the Controller. | GDPR Art. 28(3) first sentence | DPA | Not identified in supplied key provisions | No corresponding provision is identified in the supplied clause summary. | **UNSUPPORTED** | The supplied clauses contain individual Controller rights/roles, but the evidence is not sufficient to establish that the required contractual description is complete. | Full DPA text and contractual allocation of responsibilities are not supplied. | **Required** | | R28-03-06 | Processor must process personal data only on documented instructions from Controller. | GDPR Art. 28(3)(a) | DPA | Clause 2 — Processing instructions | Processor may process personal data only on documented instructions from Controller. | **PRESENT** | Clause 2 directly matches the documented-instructions requirement. | The supplied wording is general and does not address all qualifications contained in Article 28(3)(a). | **Required** only for final legal interpretation. | | R28-03-07 | Documented instructions requirement includes transfers to a third country or international organisation, subject to the statutory-law qualification in Article 28(3)(a). | GDPR Art. 28(3)(a) | DPA | Clause 2 — Processing instructions | Clause 2 requires documented instructions generally. | **AMBIGUOUS** | The clause provides a general instructions obligation, but the supplied evidence does not expressly address international transfers or the legal-requirement exception/information obligation. | Full Clause 2 text is not supplied. | **Required** | | R28-03-08 | Persons authorised to process personal data must be subject to confidentiality commitments or an appropriate statutory confidentiality obligation. | GDPR Art. 28(3)(b) | DPA | Clause 3 — Confidentiality | Employees and contractors with access to personal data must be subject to confidentiality obligations. | **PRESENT** | Clause 3 directly addresses persons with access and imposes confidentiality obligations. | The supplied evidence does not indicate whether any statutory-obligation alternative is relevant, but the contractual confidentiality route is expressly present. | **Required** only if broader legal sufficiency is being assessed. | | R28-03-09 | Processor must take measures required pursuant to GDPR Article 32. | GDPR Art. 28(3)(c) | DPA / Schedule 1 | Clause 4 — Security; Schedule 1 | Processor must maintain appropriate technical and organisational measures described in Schedule 1. | **PRESENT** | Clause 4 expressly establishes a contractual security obligation and incorporates Schedule 1 security measures. | Schedule 1's actual contents are not reproduced, so measure-level comparison with Article 32 cannot be completed here. | **Required** | | R28-03-10 | Processor must respect Article 28(2) and Article 28(4) conditions when engaging another processor. | GDPR Art. 28(3)(d) | DPA | Clause 5 — Sub-processors; Schedule 2 | Prior written authorisation is required and intended changes must be notified; approved sub-processors are listed in Schedule 2. | **AMBIGUOUS** | The supplied provisions provide substantial evidence concerning the Article 28(2) aspect. The stated source basis does not separately supply Article 28(4), while Article 28(3)(d) cross-references it. | Assessment of the Article 28(4) component is outside the supplied requirement basis unless that provision is separately included/verified. | **Required** | | R28-03-11 | Processor must assist Controller, using appropriate technical and organisational measures insofar as possible, in fulfilling obligations concerning data-subject rights. | GDPR Art. 28(3)(e) | DPA | Clause 6 — Data-subject requests | Processor will provide reasonable assistance with access, correction, deletion, and objection requests. | **PRESENT** | Clause 6 expressly provides assistance concerning multiple data-subject rights and therefore materially maps to the requirement. | The supplied summary uses "reasonable assistance" and does not detail the technical/organisational measures or the full scope of Chapter III rights. | **Required** | | R28-03-12 | Processor must assist Controller with obligations under GDPR Articles 32–36, taking into account processing nature and information available. | GDPR Art. 28(3)(f) | DPA | Clause 7 — Security incidents and DPIAs | Processor will provide assistance reasonably required by Controller. | **PRESENT** | Clause 7 expressly provides contractual assistance covering the described security-incident and DPIA subject matter. | The supplied clause summary does not itemize the full Articles 32–36 scope or the source's specific qualifications. | **Required** | | R28-03-13 | At Controller's choice, Processor must delete or return personal data after the end of services, and delete existing copies, subject to legal retention requirements. | GDPR Art. 28(3)(g) | DPA | Clause 8 — End of services | Processor must return or delete personal data at Controller's choice within 60 days, except where retention is required by law. | **PRESENT** | Clause 8 directly addresses return/delete at the Controller's choice and a legal-retention exception. | The supplied provision adds a 60-day period and does not expressly state deletion of existing copies. Whether that formulation is fully aligned with the source requires legal review. | **Required** | | R28-03-14 | Processor must make available information necessary to demonstrate compliance and allow/contribute to Controller or mandated-auditor audits, including inspections. | GDPR Art. 28(3)(h) | DPA | Clause 9 — Audits | Controller may request compliance information and conduct an audit once per year. | **AMBIGUOUS** | Clause 9 provides both information and audit mechanisms, but the supplied wording imposes a once-per-year frequency and does not expressly mention inspections or all necessary information. | Full Clause 9 text and any audit procedures/limitations are not supplied. | **Required** | | R28-03-15 | Processor must immediately inform Controller if, in its opinion, a Controller instruction infringes GDPR or other applicable EU/Member State data-protection provisions. | GDPR Art. 28(3), final sentence | DPA | Not identified in supplied key provisions | No corresponding notice obligation is identified in the supplied clause summary. | **UNSUPPORTED** | The supplied materials do not provide enough contractual text to establish coverage or absence. | No full DPA language addressing unlawful/infringing instructions is supplied. | **Required** | ### Review summary The supplied material provides identifiable contractual evidence for the principal operational obligations concerning **documented instructions, confidentiality, security, sub-processors, data-subject assistance, Article 32–36 assistance, end-of-service handling, and audits**. The principal review limitations are: **Contract-content requirements:** The supplied key provisions do not establish whether the DPA sets out the required **subject matter/duration, nature/purpose, data types, categories of data subjects, and Controller rights/obligations**. Those items should not be treated as absent because the full DPA text has not been supplied. **Sub-processors:** Clause 5 clearly contains prior written authorization and change-notification language, but the supplied evidence does not expressly establish the **opportunity to object** contemplated for general authorization. Article 28(3)(d) also cross-references Article 28(4), which is outside the stated requirement basis. **Instructions:** Clause 2 directly covers documented instructions, but the supplied evidence does not expressly address the Article 28(3)(a) treatment of **third-country/international transfers and legally required processing**. **Security:** Clause 4 provides a contractual security obligation, but the actual contents of Schedule 1 have not been supplied, so this review establishes contractual coverage rather than measure-by-measure coverage against Article 32. **End of services:** Clause 8 provides return/delete at the Controller's choice, with a 60-day period and legal-retention exception. The effect of the 60-day qualification and the absence of an express statement concerning deletion of existing copies should be reviewed against the precise Article 28(3)(g) wording. **Audits:** Clause 9 provides information and annual audit rights, but the supplied wording does not establish the full scope of the Article 28(3)(h) information, audit, and inspection language. No **CONFLICTING** contractual provisions were identified from the supplied material. No **ABSENT** classifications were used where the supplied DPA text was insufficient to support a definitive absence determination.