Article 28: Controllers must use processors with sufficient security guarantees
Article 32: Processors must implement appropriate technical measures
Articles 33–34: Breach notification obligations across the processor chain
Data Protection Impact Assessments must evaluate processor risks