Data Processor – Article 28

A data processor is when the company processes information on instructions from the data controller and does not decide the purpose of the processing. A processor may be a legal or physical person, a public authority, an institution, or another organ that has the task of processing personal data on behalf of the controller.

Type of processing

Describe the type of processing that the data recipient carries out on behalf of your company.

IT systems / information assets

In this field, you can add IT systems / information assets

  1. Click on this icon if IT systems / information assets are owned. If this is turned off, points 2 and 3 disappear.
  2. Clicking on this field will open a list of various IT systems / information assets.
  3. If an IT system / information asset is missing in section 2, you can click here and add one. It will open a form, you need to fill out. There are information boxes for all fields in the form.


Security measures

Clicking on this field will open a list of security measures for you to choose from.

Is the data recipient located in an unsafe third country?

By clicking on this field, you will be given the option to select ‘yes’, ‘no’ or ‘unknown’. If you choose ‘yes’, this will open a new field below where you must enter which country the transfer takes place to.

If transfer takes place to a data recipient located in an unsafe third country, it will be necessary to fill out a TIA. Read more about filling out a TIA here. 

Has a data processor agreement been signed?

By clicking on this field, you will be given the option to select ‘yes’, ‘no’ or ‘unknown’.

In the field below, you must answer whether the data processing agreement contains the items in the checklist. You can choose the answers ‘yes’, ‘no’ or ‘unknown’.

In the portal you can find the checklist for data processing agreements under the item “templates” in the menu bar to the left:

Below the field of whether a data processor agreement has been signed, you will be able to specify if some of the items on the checklist are missing.

Are inspections of the processor conducted?

Here you must submit whether it is ensured that data processors have the appropriate organizational and technical measures to ensure the processing of personal data. By pressing this box, you can select ‘yes’, ‘no’ or ‘unknown’.

In the box below, you can write comments on the data processor control.

Completion of form regarding data recipients.

You can add files at the bottom of the form by dragging them into the box or pressing ‘select files’. When you press ‘choose files’ a window opens where you can find the file in your documents.

When you are done filling out the form of the data recipient, click on the button in the lower right corner. It will say ‘update’ if you have edited an already created data recipient, and ‘create’ if it is a new data recipient you have created.

Please notice,

If you tap the cross in the upper right corner, the form will automatically open a window asking if you want to discard changes. By pressing ok, you close the process without saving your changes. If you want to save the changes, press cancel in this window and close the document at the bottom of the form in the right corner.


GapSolutions A/S
Uraniavej 6, 1.
DK-8700 Horsens


CVR-nr. 38582356


Sales & administration
(+45) 8844 0808

Helpline & consultants
(+45) 2199 0808



Privacy policy