# GDPR Art.28

URL: /systems/trust-and-governance/criteria/gdpr/art-28 · Id: `criterion:gdpr:Art.28`

> A controller uses only processors that give sufficient guarantees, bound by a contract with the required terms.

A controller uses only processors that give sufficient guarantees, bound by a contract with the required terms.

| Property | Value |
| --- | --- |
| Framework | GDPR |
| Reference | `Art.28` |
| Satisfied by | [Upstream review](/systems/trust-and-governance/controls/upstream-review) |