How to compare draft and executed versions for Data Processing Agreements

Compare the complete executed DPA package against the last controller-approved draft, not merely the last file exchanged. Establish each version’s provenance, compare operative text and attachments, and trace material differences to approval evidence or an unresolved issue. Assess changes to processing scope, security, incident reporting, subprocessors, deletion, and transfer arrangements. The deliverable is a source-linked comparison checklist identifying confirmed changes, evidence gaps, controller impact, required decisions, and updates to internal obligation records—while preserving the signed original.

When to use this workflow

Use this workflow when controller-side counsel receives a signed vendor DPA, discovers competing “final” versions, or must confirm that execution preserved negotiated protections. It also supports privacy teams reconciling the signed package before operational handoff.

The task is execution reconciliation, not renegotiation of every provision. Separate execution changes from weaknesses already present in the approved draft: they require different explanations and approvals.

This professional workflow uses a US transactional perspective with selected EU and California checks, not a comprehensive jurisdictional survey. Confirm coverage and roles by processing activity; do not assume California business/service-provider classifications match GDPR controller/processor classifications. Contractual consequences depend on the documents, governing law, facts, and deal context.

What you need

Collect the last approved DPA, its approval record, the executed copy, and available signature-completion materials. Include both versions of the master agreement, order forms, amendments, security schedules, processing descriptions, subprocessor lists, and applicable transfer instruments.

Preserve dated copies of incorporated webpages. Treat a live page as current evidence, not proof of signing-date content. Obtain counsel’s negotiation checklist, approved fallbacks, and written acceptance of deviations.

Assign document IDs, such as DPA-A for the approved draft and DPA-E for the executed copy. Inventory file names, dates, page counts, signature status, and attachments. Identify privacy, security, procurement, and business decision owners for unresolved differences.

Use the template

Use the Data Processing Agreements — Version comparison checklist below. You can copy this table into your working document or spreadsheet. Use one row per material difference or evidence gap and a separate inventory for package completeness.

Source fields should identify the document, clause or annex, and PDF page. If referencing a comparison-report cell, retain the underlying document citation. Capture decisive wording or a precise description in Evidence / change.

Distinguish confirmed differences, ambiguous wording, and unavailable evidence in Status / confidence. “Not present” means language was not found within the defined reviewed set—not that a missing annex contains nothing relevant.

Use Resolution / record for approval evidence, corrective-document references, or affected obligation-register entries. Keep proposed language separate from executed language.

Step by step

1. Establish the approved baseline and executed package

Identify the approval event and the documents it covered. Approval of the DPA body does not necessarily establish approval of a later security annex. Resolve competing candidate baselines before describing an execution change as unauthorized.

Check entities, services, signature pages, dates, attachment references, and page continuity. Reconcile signature-completion materials with the received package; do not use signature presence alone to infer which external materials were included.

Template output: record disputed baselines, entity mismatches, and missing execution materials, with evidence requests and owners.

2. Prepare comparable copies without changing originals

Preserve received files and create working copies for extraction and comparison. For scans, verify extracted text against page images, especially numbers, negatives, tables, checkboxes, and signature-adjacent additions.

Compare deletions and additions across the complete packages. Separate moved provisions and renumbering from substantive edits. Do not normalize away changes to defined terms, exceptions, or timing units. Check that the comparison actually processed annexes rather than silently excluding image-only pages.

Template output: identify candidate differences and extraction uncertainty. Classify a change as formatting-only after visual verification.

3. Reconcile processing descriptions and incorporated materials

Compare purposes, duration, data categories, data-subject categories, locations, and service coverage. Where GDPR Article 28 applies, the binding arrangement must specify processing subject matter, duration, nature, purpose, relevant data and data-subject categories, and controller rights and obligations. Review processing-annex changes substantively. See GDPR Article 28(3). (eur-lex.europa.eu)

Read cross-references and precedence provisions with the master agreement. If execution replaces a fixed security schedule with a webpage reference, compare the incorporation language and identify available signing-date evidence. Do not assume equivalent controls or conclude that all controls disappeared.

Template output: record scope changes, conflicting references, and unavailable incorporated versions separately, explaining their operational significance.

4. Test changes to controller protections

Compare incident notification, subprocessors, assistance, audit, deletion, and return terms alongside fees, liability provisions, and exceptions. Identify changes to the trigger, obligor, performance standard, beneficiary, or remedy.

For GDPR-covered processing, Article 33(2) requires processor breach notification without undue delay after awareness—not a universal 72-hour processor deadline. Article 28(2) requires prior specific or general written subprocessor authorization; general authorization includes notice of intended additions or replacements and an opportunity to object. It specifies no universal advance-notice period. See Articles 33(2) and 28(2). (eur-lex.europa.eu)

Check whether execution preserves the controller’s deletion-or-return choice after processing services end. Article 28(3)(g) also addresses existing copies and storage required by Union or Member State law, without prescribing a universal deletion deadline. See Article 28(3)(g). (eur-lex.europa.eu)

Template output: capture changed commitments and classify each concern as a legal question, commercial departure, or operational ambiguity.

5. Review transfer and California provisions separately

Compare SCC instrument references, modules, options, parties, annexes, and standard text. Article 28 SCCs under Decision 2021/915 are distinct from international-transfer SCCs under Decision 2021/914; the former do not themselves satisfy Chapter V transfer requirements. Commission guidance permits supplementary provisions only where they do not contradict the SCCs or prejudice protected rights. Distinguish authorized selections and annex completion from rewritten standard text. See the Commission SCC questions and answers. (commission.europa.eu)

For covered California relationships, compare specific business purposes, selling/sharing prohibitions, oversight rights, inability-to-comply notice, stop-and-remediate rights, and subcontractor commitments. These are separate checks under section 7051(a)–(b), not grounds for importing GDPR authorization procedures into California terms. (privacy.ca.gov)

Template output: create separate transfer and California rows, identifying applicability questions rather than presuming coverage.

6. Reconcile differences with approval evidence

Trace substantive changes to approval covering the same wording and context. Clarify a general instruction to “proceed” if the approver never received the revised annex.

Prioritize actual controller exposure: sensitive data, essential services, reduced visibility, weakened response support, or uncertain scope. Distinguish an approved concession from an unexplained execution change. A severity label does not determine legal effect.

Document whether to accept within authority, seek clarification, request correction or amendment, or escalate the operational decision. Preserve the signed original and prepare corrective language separately. An internal acceptance decision should not be presented as curing a statutory deficiency.

Template output: record the owner, approval evidence, response, and any accepted residual risk.

7. Update downstream records from verified operative wording

Update obligation, notice, subprocessor, and deviation records from the executed package and confirmed corrective documents. Capture triggers, recipients, timing units, exceptions, and source citations; do not invent calendar dates from vague language.

Show current executed wording and pending proposals separately. Do not replace an inconvenient signed term with the preferred draft term. Identify which internal records require revision when a corrective amendment becomes effective.

Template output: link resolved findings to affected records and assign remaining issues an owner and decision point. Close reconciliation only when material differences are explained or expressly escalated.

Worked example

Fictional scenario: Alder Quay Retail, Inc., the controller, approved a DPA with Lantern Harbor Analytics LLC for customer-support analytics. All parties, documents, clauses, and facts below are invented. Counsel’s approval identifies DPA-A, Annex A, and the attached security schedule. Procurement later supplies signed DPA-E; no approval of intervening revisions has been located.

The comparison identifies an incident-clause change, replacement of the attached security schedule with an online reference, and a narrower processing description. Inventory F-04 still lists support attachments containing customer contact details, but its continued accuracy has not been confirmed. No signing-date capture of the online schedule is available.

The package cannot be reported as matching the approved draft. Row 01 requires focused legal review, including the awareness-based rule if GDPR applies. Row 02 requires historical evidence, not an unsupported conclusion that security controls were eliminated. Row 03 requires factual confirmation before deciding whether to correct the annex or document a service change. The controller should receive these distinctions before deciding operational handoff; the vendor’s “final” label resolves none of them.

Common mistakes

• Using the last exchanged draft as the baseline. Match the comparison to documented approval and its attachment set.
• Stopping at the body-text redline. Compare schedules, processing descriptions, SCC selections, and incorporated versions independently.
• Treating OCR as definitive. Verify changed numbers, negatives, table cells, and handwritten additions against page images.
• Calling every difference unlawful. Separate applicable requirements, commercial preferences, and factual uncertainty; explain controller-specific impact.
• Editing the signed PDF in place. Preserve the original and document proposed corrections separately until the contractual response is confirmed.

Final quality check

• The baseline matches documented approval, including annexes.
• The executed inventory accounts for signatures, schedules, amendments, and referenced materials.
• Every material finding has verified document, clause, and page references.
• Extraction artifacts and apparent formatting changes have been visually checked.
• Legal observations match primary authority and documented applicability assumptions.
• Missing evidence is distinguished from absent wording and ambiguous commitments.
• Each open issue has an owner and decision point; downstream records distinguish executed terms from proposals.

Complete the workflow with DecoverAI

DecoverAI is the Legal Intelligence Platform for litigation and transactions. In its contract review workflow in Word, choose the represented party or neither and provide deal-specific instructions. Findings quote and locate clauses, rank severity, and identify missing language as not present. Lawyers can edit or insert suggestions as ordinary tracked changes under the signed-in Word user’s name, or dismiss findings with reasons. Use working copies for corrective drafting while counsel verifies executed sources and decides the response. To discuss this reconciliation workflow, book a demo. (decover.ai)

Frequently asked questions

What if there is no clearly approved draft?

Identify candidate baselines and seek confirmation from the authorized approver. Compare provisionally if necessary, but label the baseline unresolved and avoid describing differences as unauthorized.

Should we review unchanged clauses?

Check unchanged clauses that interact with a changed definition, annex, exception, or precedence provision. Record newly discovered pre-existing weaknesses separately from execution discrepancies.

How should we handle a missing incorporated webpage?

Record its reference and request a dated copy or contemporaneous evidence. Use a current page for discussion only with its date clearly identified; do not treat it as verified signing-date content.

Can we fix an execution discrepancy with a redline?

A redline communicates a proposal; it does not establish that the signed arrangement changed. Determine the appropriate correction or amendment process under the documents and applicable law, and retain both executed and proposed wording until resolved.

Sources

• GDPR, Articles 28 and 33.
• European Commission, Questions and Answers on Standard Contractual Clauses.
• California CCPA Regulations, effective January 1, 2026, section 7051.

This guide is general information about legal workflows, not legal advice for any matter. It was drafted and reviewed with AI assistance. The worked example is fictional. Contract rights and procedure depend on the governing law, the actual wording, and the facts, so check the cited sources and the rules that apply in your jurisdiction before relying on it.