CLAIM-2026-09-28-12

GDPR Article 28(3)(f) requires the processor to assist the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36, taking into account the nature of processing and the information available to the processor; Article 28(3)(h) requires the processor to make available all information necessary to demonstrate compliance and to allow for and contribute to audits.

Why it matters

This is the lever: assistance is owed, but bounded by the information the processor holds, which is why the request has to be in writing and specific.

Sources

• intersoftco2026processor