Pursuant to Article 28, contracts between controllers and processors (and processors and subprocessors) must do the steps included in this downloadable checkist.