Controller and processor

Chapter 4

Section 1: General obligations

Article 24

Responsibility of the controller

 Article 25

Data protection by design and by default

 Article 26

Joint controllers

 Article 27

Representatives of controllers or processors not established in the Union

 Article 28

Processor

 Article 29

Processing under the authority of the controller or processor

 Article 30

Records of processing activities

 Article 31

Cooperation with the supervisory authority

Section 2: Security of personal data

Article 32

Security of processing

 Article 33

Notification of a personal data breach to the supervisory authority

 Article 34

Communication of a personal data breach to the data subject

Section 3: Data protection impact assessment and prior consultation

Article 35

Data protection impact assessment

 Article 36

Prior consultation

Section 4: Data protection officer

Article 37

Designation of the data protection officer

 Article 38

Position of the data protection officer

 Article 39

Tasks of the data protection officer

Section 5: Codes of conduct and certification

Article 40

Codes of conduct

 Article 41

Monitoring of approved codes of conduct

 Article 42

Certification

 Article 43

Certification bodies