The Belgian Data Protection Authority (APD) published the results of its 2025 audit campaign earlier this year: in <strong>78% of processing agreements analysed</strong>, at least one mandatory clause of Article 28 GDPR was missing or poorly drafted. Here are the seven most frequently forgotten.
1. Precise description of the processing
A generic reference to "all data necessary for service performance" is insufficient. You must list by category the data concerned, the purpose of each processing operation, the duration, and the data subjects. This is the clause that protects your company if the processor drifts.
2. Confidentiality obligation extended to staff
The processor must commit to ensuring that its employees and sub-processors are bound by a written confidentiality obligation. A simple mention that "the provider guarantees confidentiality" is insufficient in the event of an audit.
3. The regime for sub-processors
Prior or general authorisation? If general, with what notification period? The clause must decide. Without this, any recourse to a sub-processor (including cloud hosting) constitutes a contractual breach.
4. Assistance in the event of a breach
The processor must notify any breach "without delay", but your contract must set a maximum in hours (24, 48, 72h depending on criticality). This deadline is what enables you to meet your own 72-hour notification obligation to the APD.
5. Cooperation with rights requests
When a data subject exercises a right of access or erasure, who responds? The contract must allocate the burden and set the deadlines for transmitting requests received by the processor.
6. The fate of data at end of contract
Return, deletion, anonymisation? In what format? With what written proof? This is the most frequently forgotten clause — and the one that causes the most problems during provider changes.
7. The right to audit
GDPR requires the processor to "make available to the controller all information necessary to demonstrate compliance". In practice, this means an audit right — on-documents or on-site — that your contract must organise.
What we see in the field
Across the 40 supplier contracts we audit each year on average, clause 6 (end of contract) is missing in more than 9 cases out of 10. These omissions go unnoticed while nothing moves — but as soon as a provider change, incident, or audit occurs, the cost of correction is disproportionate.
The good news: these seven clauses fit on two well-drafted pages. It's a quick compliance project, with very concrete returns from the first contract renewal.