How to prepare a contract diligence findings report for Data Processing Agreements

Prepare a controller-side DPA diligence report by defining the processing perimeter, assembling the operative contract package, and testing its terms against applicable requirements and the controller’s review criteria. Record each material finding with its source, evidence status, controller impact, recommended response, and decision owner. The resulting report should distinguish confirmed deficiencies from missing evidence, factual assumptions, and unresolved legal questions. It should identify what needs correction before signing or closing, what requires investigation, and which residual risks need express acceptance.

When to use this workflow

Use this workflow when privacy counsel, transaction lawyers, or in-house teams assess vendor DPAs for an acquisition, investment, outsourcing arrangement, or supplier onboarding decision. It supports both a critical processor review and a portfolio requiring consistent, traceable findings rather than clause summaries.

This is contract diligence, not a complete privacy compliance assessment. For US-led transactions, evaluate California business/service-provider classifications separately from GDPR controller/processor roles. Confirm coverage, exemptions, and actual activities before selecting a baseline. The legal discussion addresses selected EU and California requirements using the October 13, 2026 research cutoff; it is not a comprehensive US or global survey. Conclusions depend on the operative language, applicable law, processing facts, and transaction context.

What you need

Collect the executed DPA, master agreement, relevant orders, amendments, security schedules, subprocessor information, transfer instruments, and dated copies of incorporated webpages. Obtain the latest approved draft if execution discrepancies are within scope. Identify unavailable materials explicitly.

Request a processing description covering contracting entities, service functions, data categories, affected individuals, hosting and access locations, downstream providers, and operational dependency. Ask whether the vendor claims independent uses of the data; a service description alone may not resolve roles.

Obtain the transaction decision date and the controller’s versioned review checklist. Separate legal requirements, commercial preferences, fallback positions, and approval thresholds. The checklist is the legal team’s work product, not evidence that every departure is unlawful.

Use the template

Use the Data Processing Agreements — Contract diligence findings report template below. Copy this table into your working document or spreadsheet, using one row per decision-relevant finding.

ID / topic	Source	Evidence status	Baseline / finding	Controller impact	Priority	Action	Owner / disposition

In Source, record the document ID, version, section or page, and a short operative excerpt. Reference a supporting extraction record for longer provisions, preserving triggers, exceptions, deadlines, and cross-references.

Use distinct Evidence status values: confirmed text, not present in reviewed package, document unavailable, ambiguous, and fact unverified. Baseline / finding should identify whether the comparison is legal, commercial, or operational. Priority measures decision significance, not proof of illegality. Owner / disposition should include the responsible person, target decision date, and status: open, corrected, accepted, or outside scope.

Precede the table with a short summary stating the review perimeter, document cutoff, material limitations, and decisions requested. The table supplies the supporting evidence.

Step by step

1. Establish the processing and decision perimeter

Identify the contracting entities and activities performed on the controller’s behalf. Separate service delivery from asserted independent data uses. Confirm sensitivity, scale, access locations, and whether replacing the service is operationally realistic.

Tie the review to a specific decision: vendor signature, acquisition closing, or approval of a remediation plan. Do not treat an unresolved classification as established merely to complete the report. Record the factual question and explain which conclusions depend on its answer.

Template output: material scope uncertainties, their effect on the review, and the business or legal owner responsible for resolution.

2. Reconstruct the operative contract package

Create a document index with stable IDs and versions. Read incorporation and precedence provisions across the DPA, master agreement, orders, amendments, and transfer documents. Preserve the online schedule version supplied for the review; today’s webpage may not establish historical terms.

Check completed annexes and signatures. If a referenced security appendix is unavailable, report an evidence gap rather than concluding that no security commitments exist. Distinguish a document not supplied from a provision absent from an otherwise complete package.

Template output: documentary gaps and conflicts, with the relevant reference and a request for the missing or controlling text.

3. Extract terms against the correct baseline

For GDPR-covered processing on behalf of a controller, Article 28(3) requires a binding arrangement specifying the processing subject matter, duration, nature, purpose, personal-data types, data-subject categories, and controller rights and obligations. Test completed schedules, not simply the presence of a DPA heading (GDPR, Article 28(3)).

For covered California service-provider or contractor relationships, section 7051(a)(1)–(2) requires contractual prohibitions on selling or sharing covered information and specific business purposes rather than a generic reference to the entire agreement (California regulations, section 7051).

Also review instructions, confidentiality, security, assistance, audit, and exit provisions against the applicable checklist. Extract operative wording and exceptions before characterizing a deviation. Cite the controller’s checklist version—not statutory authority—when the baseline is a commercial preference.

Template output: findings identifying the applicable baseline, supporting text, and precise departure or unresolved question.

4. Test notices, subprocessors, and exit provisions

Read each commitment as a sequence: trigger, obligor, recipient, timing, exceptions, and consequence. GDPR Article 28(2) requires prior specific or general written subprocessor authorization. General authorization requires notice of intended additions or replacements and an opportunity to object, without prescribing a universal advance-notice period (GDPR, Article 28(2)).

Article 33(2) requires processor breach notification without undue delay after awareness—not a universal 72-hour processor deadline. Article 28(3)(g) requires return or deletion at the controller’s choice after processing services end, and deletion of existing copies unless Union or Member State law requires storage; it specifies no universal deletion deadline (GDPR, Articles 28 and 33).

Test whether notice channels, objection consequences, backup treatment, and return procedures make the commitments usable. Separate required protections from requested operational detail, such as completion evidence.

Template output: notice, downstream-processing, and exit findings with their triggers and practical consequences.

5. Assess transfers and interacting protections

Do not accept “SCCs included” as a transfer conclusion. The Commission distinguishes Article 28 clauses under Decision 2021/915 from international-transfer clauses under Decision 2021/914; the former do not themselves satisfy Chapter V transfer requirements (Commission SCC guidance). Identify the instrument, parties, selections, annexes, and processing facts requiring specialist assessment.

When relying on Commission SCCs, distinguish authorized selections and annex completion from rewriting standard text. Additional terms must not contradict the clauses or undermine protected rights (Commission SCC guidance).

Read assistance, security, oversight, fees, liability, and termination together. For covered California relationships, separately check section 7051’s oversight rights, inability-to-comply notice, rights upon notice to stop and remediate unauthorized use, and compliant subcontractor contracts; these are not interchangeable with GDPR authorization requirements (California regulations, section 7051).

Template output: interacting-clause findings and assigned transfer questions, without unsupported conclusions about transfer validity.

6. Rank findings and formulate decisions

Assess priority using processing exposure, service dependency, available mitigations, and transaction timing. Keep certainty separate from severity: an unavailable security appendix can be decision-critical without proving deficient contractual safeguards.

Recommend a specific response: obtain evidence, amend identified language, seek specialist determination, or request risk acceptance. State the minimum correction sought and the residual exposure if it is declined. A generic instruction to “renegotiate” does not tell the transaction team what decision is needed.

Template output: calibrated priorities, concrete actions, decision owners, and acceptance requests for unresolved residual risk.

7. Reconcile and issue the report

Check summary statements against the underlying rows and sources. For portfolios, group comparable services and regimes. Do not count unavailable documents as confirmed deviations or assume different wording necessarily provides different protection.

Reconcile executed documents against the versions supporting the conclusions. Update findings affected by late amendments or annex changes. Issue a decision summary separating factual follow-up, proposed contractual corrections, and risks awaiting acceptance. Preserve open items rather than treating issuance as resolution.

Template output: final dispositions, assigned open issues, report version, and document cutoff.

Worked example

Fictional scenario: Alderbridge Holdings proposes to acquire Cedar Quay Software, which uses Nimbus Ledger Services to host customer-support records. All parties and documents in this example are fictional. Counsel has confirmed that Cedar Quay is the controller and Nimbus its processor for GDPR-covered processing. The business cannot readily replace Nimbus before closing.

The reviewed package comprises DPA-01 version 2, Schedule A version 2, and MSA-01 version 1. No other reviewed provision modifies the terms below. Schedule A references Appendix S, which was not supplied. Section 5 grants general subprocessor authorization but provides only post-appointment list updates, with no prospective notice or objection procedure. Section 9 gives Nimbus the exit election.

ID / topic	Source	Evidence status	Baseline / finding	Controller impact	Priority	Action	Owner / disposition
F1 / Subprocessors	DPA-01 v2 §5: “Supplier may update its list after appointment.”	Confirmed text; general authorization in §5	No prospective notice or objection opportunity; Article 28(2) baseline	Cedar Quay cannot assess planned changes under this wording	High	Require prospective notice and an objection process; confirm planned appointments	Privacy counsel / open before closing decision
F2 / Security appendix	Schedule A v2 §3 references Appendix S	Document unavailable	Security commitments cannot be fully assessed	Incomplete evidence, not proof of absent safeguards	High	Obtain applicable appendix and technical-owner assessment	Deal counsel / evidence request pending
F3 / Exit choice	DPA-01 v2 §9: “Supplier chooses return or deletion.”	Confirmed text	Supplier election conflicts with controller-choice baseline	Cedar Quay may lose records needed for migration	High	Correct election right; separately request completion evidence	Privacy and business owners / amendment proposed

F1 and F3 support targeted amendments on established facts. F2 supports an evidence request and qualified recommendation, not an allegation that Nimbus lacks security controls. The controller’s requested completion evidence is a commercial protection, separate from the statutory election right. Operational dependency increases the significance of exit rights but creates no statutory deletion deadline. The report assigns who decides whether closing may proceed with each issue outstanding.

Common mistakes

Reviewing the DPA alone. Read precedence terms, master-agreement restrictions, and incorporated schedules before assessing a protection.
Conflating evidence gaps with drafting gaps. Identify what was unavailable and reserve affected conclusions.
Applying one role across regimes. Confirm activities and classifications before selecting EU or California requirements.
Treating SCC presence as transfer clearance. Identify the instrument and annexes, then assign unresolved transfer questions.
Calling every preference mandatory. Separate legal corrections from commercial improvements and identify approval responsibilities.

Final quality check

Each material finding identifies a document version and clause or page.
Quotations, exceptions, and cross-references match the source text.
Legal propositions match the cited authority and applicable relationship.
Roles, regimes, and processing facts are confirmed or explicitly unresolved.
Unavailable documents are distinguished from absent or ambiguous language.
Priorities reflect controller impact, and recommendations specify actions and owners.
The summary matches the table; open issues are resolved or expressly assigned.

Complete the workflow with DecoverAI

DecoverAI is the Legal Intelligence Platform for litigation and transactions. Its due diligence capabilities include bulk document classification to organize materials and prioritize human review; tabular review supports work across documents. For targeted follow-up, contract review in Word supports represented-party selection, deal-specific instructions, and findings that quote clauses, rank severity, locate text, and identify missing language as not present. Lawyers verify the package, legal conclusions, and final report. Book a demo to discuss this DPA diligence workflow.

Frequently asked questions

Should every reviewed clause become a finding?

No. Preserve extraction as supporting work, but report material deviations, uncertainties, and decisions. Record reviewed topics separately so report silence is not mistaken for an omitted review area.

Can the report recommend proceeding with missing annexes?

It can present a conditional recommendation identifying the evidence gap, affected conclusions, decision owner, and consequences of proceeding. Do not describe the package as fully assessed or imply risk acceptance cures a legal deficiency.

How should controller preferences appear alongside legal requirements?

Label each baseline. A requested notice period or completion-evidence procedure may be commercial even where the underlying notice or deletion obligation has a legal basis. Keep the requested improvement distinct from the required correction.

What belongs in the executive summary?

State the review perimeter, limitations, decision-critical findings, and requested actions. Distinguish confirmed problems from missing evidence and identify residual risks requiring approval. Reference the finding IDs supporting each requested decision.

Sources

This guide is general information about legal workflows, not legal advice for any matter. It was drafted and reviewed with AI assistance. The worked example is fictional. Contract rights and procedure depend on the governing law, the actual wording, and the facts, so check the cited sources and the rules that apply in your jurisdiction before relying on it.