---
title: "Chapter IV GDPR: Controller and processor"
canonical: "https://dposchool.com/gdpr/chapter/4"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
language: "en"
publisher: "DPO School"
---

# Chapter IV: Controller and processor

Articles 24 to 43 of Regulation (EU) 2016/679.

## Section 1: General obligations

- [Article 24 Responsibility of the controller](https://dposchool.com/gdpr/article/24)
- [Article 25 Data protection by design and by default](https://dposchool.com/gdpr/article/25)
- [Article 26 Joint controllers](https://dposchool.com/gdpr/article/26)
- [Article 27 Representatives of controllers or processors not established in the Union](https://dposchool.com/gdpr/article/27)
- [Article 28 Processor](https://dposchool.com/gdpr/article/28)
- [Article 29 Processing under the authority of the controller or processor](https://dposchool.com/gdpr/article/29)
- [Article 30 Records of processing activities](https://dposchool.com/gdpr/article/30)
- [Article 31 Cooperation with the supervisory authority](https://dposchool.com/gdpr/article/31)

## Section 2: Security of personal data

- [Article 32 Security of processing](https://dposchool.com/gdpr/article/32)
- [Article 33 Notification of a personal data breach to the supervisory authority](https://dposchool.com/gdpr/article/33)
- [Article 34 Communication of a personal data breach to the data subject](https://dposchool.com/gdpr/article/34)

## Section 3: Data protection impact assessment and prior consultation

- [Article 35 Data protection impact assessment](https://dposchool.com/gdpr/article/35)
- [Article 36 Prior consultation](https://dposchool.com/gdpr/article/36)

## Section 4: Data protection officer

- [Article 37 Designation of the data protection officer](https://dposchool.com/gdpr/article/37)
- [Article 38 Position of the data protection officer](https://dposchool.com/gdpr/article/38)
- [Article 39 Tasks of the data protection officer](https://dposchool.com/gdpr/article/39)

## Section 5: Codes of conduct and certification

- [Article 40 Codes of conduct](https://dposchool.com/gdpr/article/40)
- [Article 41 Monitoring of approved codes of conduct](https://dposchool.com/gdpr/article/41)
- [Article 42 Certification](https://dposchool.com/gdpr/article/42)
- [Article 43 Certification bodies](https://dposchool.com/gdpr/article/43)

This is reference material, not legal advice.

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / Chapter IV

Previous: [Chapter III: Rights of the data subject](https://dposchool.com/gdpr/chapter/3)

Next: [Chapter V: Transfers of personal data to third countries or international organisations](https://dposchool.com/gdpr/chapter/5)

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents