How to review data deletion commitments for Data Processing Agreements

Review data deletion commitments by identifying what must be returned or erased, who must act, what triggers performance, and which copies or exceptions survive. Read the DPA alongside termination, export, retention, and transfer terms, then test the wording against the provider’s storage and subprocessor arrangements. The deliverable is a clause-cited deletion checklist distinguishing legal requirements from negotiated protections, identifying missing evidence, and recording amendments, decision owners, and residual risk. Approval should address both the contractual promise and whether the proposed return-and-deletion sequence is workable.

When to use this workflow

Use this workflow when controller-side counsel reviews a new DPA, renewal, vendor amendment, or proposed exit terms. Prioritize it where sensitive records, long-lived backups, or downstream support providers complicate deletion.

This is a contractual review, not a deletion implementation project or comprehensive privacy assessment. It addresses selected EU GDPR and California requirements using an October 13, 2026 research cutoff. Confirm territorial coverage, exemptions, and roles by activity; California business/service-provider classifications should not automatically be equated with GDPR controller/processor classifications. Conclusions depend on the actual language, governing law, facts, and service architecture.

What you need

Collect:

• The DPA, master agreement, orders, amendments, security schedules, and applicable transfer instruments.
• Dated copies of incorporated retention, backup, account-closure, and export policies, including precedence provisions.
• A processing description covering entities, purposes, personal-data categories, affected individuals, and relevant locations.
• Available information about active storage, replicas, backups, logs, support systems, derived datasets, and subprocessors.
• The controller’s export requirements, transition dependencies, preferred deletion timing, and approval thresholds.
• The controller’s negotiation checklist separating legal requirements, preferred protections, and fallback positions.

Ask technical and procurement owners to identify constraints. An unanswered architectural question is missing evidence, not proof that deletion is impossible or that the provider has breached an obligation.

Use the template

Use Data Processing Agreements — Data deletion checklist as the review record. You can copy this table into your working document or spreadsheet. Create separate rows for independently assessable commitments, including systems with different retention periods.

In Source/version, record the document ID, version, clause/page, and short operative extract, or reference an extract in your working file. Trigger/election identifies the event, instruction channel, and person controlling the return-or-deletion choice. Timing/proof distinguishes binding deadlines from targets and identifies completion evidence.

Use Exception/gap to distinguish “not present,” “document unavailable,” and “meaning unclear.” Assessment/action should identify a legal requirement, commercial preference, or factual question and the proposed response. Owner/status names the resolver or authorized approver and records the disposition; “pending” alone is insufficient.

Step by step

1. Establish the processing scope and controlling documents

Identify the provider’s role for each activity. Customer content, support communications, and provider account administration may need separate treatment rather than one assumption about all vendor-held information.

Where Article 28 applies, the binding processor arrangement must specify the processing subject matter, duration, nature, purpose, data types, data-subject categories, and controller rights and obligations. Use that description to establish the deletion scope. See GDPR Article 28(3).

Read precedence provisions before resolving conflicting terms. Record the controlling sources, relevant definitions, and unresolved scope questions in the template. Explain exclusions rather than silently omitting activities.

2. Extract the election, trigger, and operative duty

Separate agreement termination, order expiry, cessation of processing services, account closure, and a controller instruction. These events may differ. Check whether a request is required, who receives it, and what happens if no election arrives.

For covered processing, Article 28(3)(g) requires deletion or return at the controller’s choice after processing services end, and deletion of existing copies unless Union or Member State law requires storage. It specifies no universal deletion deadline. See GDPR Article 28(3)(g).

Record the trigger, election holder, duty, and timing. Flag provider-controlled choice separately from undefined completion timing: they require different amendments. Check whether the clause preserves deletion of provider-held copies after return.

3. Test return mechanics before approving deletion timing

Determine whether the controller can obtain a usable export before destructive action begins. Review formats, attachments, metadata, delivery security, export availability, and dependencies on paid assistance. Request technical confirmation where “standard format” lacks concrete meaning.

A negotiated sequence might provide an election period, export delivery, a bounded verification opportunity, and deletion afterward. Do not present that sequence as a statutory timetable or make deletion depend on indefinite controller acceptance.

Record export dependencies, fees, proposed timing, and the business owner validating usability. If the master agreement terminates portal access immediately, identify how return will occur afterward. More time to request an export does not resolve an inaccessible delivery channel.

4. Trace copies, backups, logs, and downstream storage

Map the promise across active databases, replicas, disaster-recovery media, logs, support systems, and derived datasets containing covered personal data. A label such as “analytics” does not establish that information falls outside the agreed deletion scope.

Ask how retained backups are isolated, when they expire, and how restored data is treated. Seek achievable wording addressing reintroduced data. These are review recommendations, not a legally approved backup-retention model.

Examine downstream contractual coverage and available evidence. For covered California relationships, section 7051(b) requires compliant subcontractor contracts; it does not establish GDPR-style controller authorization. See California CCPA Regulations, section 7051(b).

Create separate rows where systems or providers have materially different commitments. Record technical uncertainty explicitly rather than inferring coverage from the primary provider’s deletion statement.

5. Narrow retention exceptions and reconcile conflicting terms

Test each exception for its asserted legal basis, affected data, duration, access, and permitted use. “Legal, compliance, or business purposes” combines distinct positions and does not establish that every retention purpose is justified.

Where Article 28(3)(g) applies, compare exceptions with its Union-or-Member-State-law storage qualification. Ask the provider to identify the asserted basis; do not assume a generic “applicable law” reference answers the question. Assign broader retention requests for counsel’s determination.

Check retention policies, security schedules, and survival clauses for conflicting permissions. If Commission SCCs are incorporated, identify the instrument: Article 28 SCCs and international-transfer SCCs serve different functions. Additions must not contradict the clauses or undermine protected rights. See the Commission’s SCC questions and answers, general section.

Record a proposed narrowing amendment or assigned legal question, citing each conflicting source.

6. Assess completion evidence and consequences of failure

Determine what would substantiate completion: written confirmation, system-specific dates, a retained-data schedule, or downstream confirmation. Check the applicable contractual instrument before classifying a certificate as an additional request; an incorporated clause may already require it.

Review evidence access, assistance fees, audit restrictions, termination rights, and liability limitations together. Distinguish a specific requested deliverable from broader existing oversight rights.

For covered California relationships, section 7051(a)(6)–(8) addresses oversight, notice when the provider determines it cannot meet CCPA obligations, and rights upon notice to stop and remediate unauthorized use. These provisions do not supply a universal numerical notice period. See California CCPA Regulations, section 7051(a)(6)–(8).

Record required and requested evidence separately, with remedy concerns and an escalation owner.

7. Resolve deviations and verify the final package

Prioritize issues using sensitivity, processing scale, exit dependency, and the consequences of continued retention. Separate confirmed drafting deficiencies from missing documents and technical assumptions.

Record each material issue’s amendment, fallback, approving owner, and residual risk. Do not treat commercial risk acceptance as curing an unmet legal requirement. A delayed-backup-deletion proposal needs a defined scope, safeguards, timing, and evidence—not simply an “accepted” label.

Compare the signature package with the approved draft, including annexes and incorporated versions. Update rows to reflect final wording. Before approval, resolve each material issue or expressly assign it to an authorized decision-maker with a clear approval condition.

Worked example

Fictional scenario: Larkspur Benefits LLC is reviewing employee-benefits document hosting by Alder Vault Services Inc. All parties, documents, provisions, and periods are fictional. For this example, counsel has determined that the relevant processing falls within GDPR scope.

D1, draft DPA version 3, permits a controller election to return or delete. Return requires a request within 15 days after termination; active-system deletion occurs within 30 days. Backups may remain for 180 days. M1 ends portal access immediately at termination. R1 permits retention for “business assurance.” The available package contains no support-subprocessor deletion terms or explanation of completion verification.

DEL-01 changes the response from extending the request window to making return operationally available. The documents do not establish that alternative delivery is impossible; they leave it unresolved.

DEL-02 does not establish that 180 days is acceptable or unlawful. It identifies facts needed for legal and operational assessment. DEL-03 separates known broad wording from unavailable downstream evidence: the record does not support a finding of actual subprocessor failure. Approval remains conditional on resolving these issues, not merely acknowledging them.

Common mistakes

• Reading only the deletion paragraph. Reconcile access termination, incorporated policies, precedence, and survival provisions.
• Assuming “customer data” covers every copy. Test definitions against logs, support records, derived data, and downstream storage.
• Inventing a universal deletion deadline. Separate negotiated periods from applicable requirements and preserve the actual trigger.
• Accepting backup rotation without restoration treatment. Establish the outer period, access safeguards, and handling of reintroduced data.
• Treating any certificate as sufficient. Compare its scope, exclusions, and supporting information with the operative obligations.

Final quality check

• Every material finding identifies a retrievable version and clause/page.
• Roles, applicable regimes, and unresolved classifications are documented.
• Election, instruction channel, trigger, and timing are clear.
• Export arrangements reconcile with access termination and deletion.
• Active systems, backups, logs, derived data, and downstream copies are addressed or assigned.
• Retention exceptions have defined scope, asserted basis, and disposition.
• Legal propositions match primary sources; preferences remain distinguishable.
• Final wording matches approvals; open issues have owners and approval conditions.

Complete the workflow with DecoverAI

DecoverAI is the Legal Intelligence Platform for litigation and transactions. In its contract review workflow in Word, choose the represented party and provide controller-specific deletion instructions. Findings quote and locate clauses, rank severity, and identify missing language as not present. Lawyers edit or insert suggestions as ordinary tracked changes in the signed-in Word user’s name, or dismiss findings with reasons. Tabular review supports work across documents; the checklist remains your work product and legal judgment remains with counsel. Book a demo to assess fit with your DPA review process.

Frequently asked questions

Does GDPR require deletion within 30 days after termination?

Article 28(3)(g) provides no universal deletion deadline. Assess the end-of-services trigger and negotiate precise timing appropriate to return arrangements and substantiated constraints. See GDPR Article 28(3)(g).

Can we accept deletion through normal backup rotation?

Do not decide from that phrase alone. Establish the outer retention period, covered copies, access restrictions, restoration treatment, and completion evidence. Assess the wording and applicable requirements rather than treating the provider’s technical practice as sufficient justification.

Should return and deletion have separate checklist entries?

Usually. Return involves election, format, delivery, and usability; deletion involves systems, copies, timing, and exceptions. Cross-reference the entries so return does not obscure the treatment of remaining provider copies.

What if downstream deletion evidence is unavailable?

Record missing evidence separately from contractual shortcomings. Request downstream commitments and an explanation of completion verification. Escalate unresolved uncertainty to the designated approver without recording unsupported compliance or breach conclusions.

Sources

• GDPR, Article 28: processor arrangements and end-of-services deletion or return.
• European Commission, Questions and Answers on Standard Contractual Clauses: distinct SCC instruments and limits on contradictory additions.
• California CCPA Regulations, effective January 1, 2026, section 7051: covered oversight and subcontractor contract requirements.

This guide is general information about legal workflows, not legal advice for any matter. It was drafted and reviewed with AI assistance. The worked example is fictional. Contract rights and procedure depend on the governing law, the actual wording, and the facts, so check the cited sources and the rules that apply in your jurisdiction before relying on it.