Review a Data Processing Agreement from the controller’s perspective by matching the proposed processing to the complete contract package, identifying applicable requirements, and testing whether protections work operationally. Extract the controlling language, distinguish legal requirements from negotiating preferences, and resolve conflicts across the DPA, master agreement, security schedule, and transfer instruments. The deliverable is a clause-level review checklist with source references, prioritized findings, proposed changes, and named decision owners—not simply provisions marked acceptable or unacceptable.
Use this workflow when privacy counsel, commercial lawyers, or an in-house team must approve a vendor’s DPA before signing, renewal, or a material processing change. Concrete triggers include new data categories, secondary uses, support locations, or subprocessors.
The review concerns a controller procuring processing services. For US-based teams, the legal discussion covers selected California and EU requirements, not a comprehensive privacy-law survey. Determine coverage, exemptions, and roles by activity before applying either regime; do not treat a GDPR processor label as resolving California service-provider status. The relevant provisions address distinct relationships (GDPR, Article 28; California regulations, §§ 7050–7051). Contract conclusions also depend on wording, governing law, facts, and deal context.
Collect four sets of inputs:
Assign document IDs and preserve reviewed versions. The negotiating checklist guides this transaction; it does not establish that every preferred provision is legally required.
The companion template is Data Processing Agreements — Contract review checklist. You can copy this table into your working document or spreadsheet. Use one row per issue, splitting clauses that require separate decisions.
| ID / topic | Source / version | Operative text | Baseline / type | Evidence / uncertainty | Controller impact | Action / owner | Status / reason |
|---|---|---|---|---|---|---|---|
Source / version captures document ID, version, section, and page. Operative text preserves the relevant wording, including triggers, exceptions, and cross-references; use a short extract with a precise citation for lengthy clauses.
Baseline / type distinguishes legal requirements, commercial preferences, and factual questions. Evidence / uncertainty separates “not present in reviewed package,” “referenced document unavailable,” and “ambiguous.” Record priority and practical consequences under Controller impact. Use Status / reason for disposition, approval rationale, or an outstanding dependency. Link related row IDs rather than repeating inconsistent conclusions.
Ask what the supplier actually does with personal data, including support access, analytics, and secondary use. Map roles by activity rather than accepting introductory labels. Identify activities requiring separate treatment.
For GDPR-covered processor arrangements, Article 28(3) requires a binding arrangement specifying subject matter, duration, nature, purpose, data types, data-subject categories, and controller rights and obligations. Check populated schedules against those elements (GDPR, Article 28(3)).
Record: confirmed activities, applicability assumptions, missing facts, and the person responsible for each classification question. Do not recommend unconditional approval while material scope questions remain unresolved.
Read precedence clauses before evaluating protections. Determine whether the DPA overrides inconsistent master terms and whether security or transfer provisions have separate priority rules. Preserve online terms and verify that schedules describe the purchased service.
Extract each material clause’s obligor, beneficiary, trigger, timing, exceptions, and cross-references. An audit right may be narrowed elsewhere by fees or report-only access. A deletion obligation may depend on an undefined termination event.
Record: source-linked findings and missing-document requests. An unavailable annex is an evidence gap, not proof that its protections are absent. Identify any conflict whose resolution could change the review outcome.
Compare permitted processing with documented instructions. Flag product-improvement permissions and other secondary uses for factual and legal assessment. For GDPR-covered arrangements, check confidentiality, security measures, rights-request assistance, compliance assistance, and audit provisions against Article 28(3)(a)–(f) and (h) (GDPR, Article 28).
For covered California relationships, section 7051 requires specific business purposes, selling and sharing prohibitions, and restrictions on use outside permitted purposes and the direct relationship. It also addresses oversight, notice of inability to comply, and rights to stop and remediate unauthorized use (California regulations, § 7051(a)).
Ask security and privacy operations whether promised evidence and assistance are usable. Examine response mechanics, fees, and feasibility qualifiers rather than accepting a general compliance warranty.
Record: the gap, legal or commercial baseline, proposed wording, and operational reviewer. Specify which service-specific security commitments require confirmation.
Map known subprocessors by entity, function, location, and notice channel. GDPR Article 28(2) requires prior specific or general written authorization; general authorization requires notice of intended additions or replacements and an opportunity to object, without prescribing a universal notice period (GDPR, Article 28(2)). Ask what happens to processing if an objection remains unresolved.
Do not automatically import that model into California: section 7051(b) addresses compliant subcontractor contracts (California regulations, § 7051(b)).
For transfers, distinguish Article 28 SCCs under Decision 2021/915 from transfer SCCs under Decision 2021/914. The former do not themselves satisfy Chapter V. Verify the instrument, selections, and annexes; additional provisions must not contradict SCCs or prejudice protected rights (Commission SCC guidance, sections I–III). Do not treat an attached instrument as completing the transfer assessment.
Record: separate subprocessor and transfer findings, unknown access locations, and the responsible counsel.
Read incident wording for awareness, recipient, initial content, and updates. Article 33(2) requires processor notification without undue delay after awareness of a personal-data breach—not a universal 72-hour processor deadline (GDPR, Article 33(2)). Assess any negotiated numerical limit alongside, not instead of, that baseline. Confirm escalation contacts and whether initial notification can precede a complete investigation.
For exit, Article 28(3)(g) requires deletion or return at the controller’s choice after processing services end, with deletion of copies unless Union or Member State law requires storage. It supplies no universal deletion deadline (GDPR, Article 28(3)(g)). Test active systems, backups, logs, downstream copies, retention explanations, and return formats.
Record: triggers, contractual periods, exceptions, election mechanics, requested completion evidence, and technical limitations. Do not translate vague timing into an invented deadline.
Read caps, indemnities, exclusions, termination rights, and transition charges alongside substantive protections. Assess enforceability separately where necessary. When SCCs apply, check that broader liability provisions do not contradict their liability scheme (Commission SCC guidance, section III).
Prioritize findings by sensitivity, scale, service dependency, and mitigations. Separate required corrections from preferred protections and factual approval conditions. Explain why each departure matters to this controller; avoid unsupported assertions that a position is market standard.
Record: priority, proposed change, fallback, approving authority, and residual risk. Link dependencies—for example, an unresolved subprocessor objection and termination charges that make exit impractical.
Compare the revised package with the last reviewed version. Confirm negotiated language, numbering, annexes, optional selections, and incorporated versions. Recheck consequential master-agreement changes.
Close findings only through revised text, verified facts, or an authorized decision. Business acceptance does not establish legal compliance or resolve applicability. Keep those determinations distinct.
Record: disposition, approval-draft citation, decision owner, and approval conditions. If signing has occurred, reconcile the executed package before treating the checklist as final; unexplained changes reopen affected findings.
Fictional scenario: Alder Quay Retail proposes engaging Lantern Desk Systems to host support tickets. Tickets contain contact details and may include volunteered health information. The business confirms EU and California customers, but counsel has not completed territorial, exemption, or role analysis. Customer location alone is not treated as resolving applicability. Remote-support locations remain unknown.
The fictional package contains DPA-D1, MSA-M1, and SEC-S1, each version 1. A referenced subprocessor list was not supplied. All parties, documents, clauses, and references below are fictional.
| ID / topic | Source / version | Operative text | Baseline / type | Evidence / uncertainty | Controller impact | Action / owner | Status / reason |
|---|---|---|---|---|---|---|---|
| R1 / Incidents | DPA-D1 v1 § 7, p. 4 | “Notify within 72 hours after confirming a breach.” | GDPR baseline if applicable; contractual timing | Confirmation threshold undefined | High: awareness may precede confirmation | Use awareness trigger and without-undue-delay wording; negotiate outer limit / privacy counsel | Open: correction not accepted |
| R2 / Subprocessors | DPA-D1 v1 § 5, p. 3 | “Supplier may update its online list.” | Authorization and objection review | List unavailable; no notice mechanism located in package | High: changes cannot be assessed | Obtain list; address authorization, notice, and objection consequences / procurement counsel | Hold: evidence and text needed |
| R3 / Exit | DPA-D1 v1 § 10, p. 6; MSA-M1 v1 § 12, p. 8 | “Delete production data after termination”; “Transition assistance is separately charged.” | GDPR election/copies baseline if applicable; commercial exit terms | Return, backups, and format unaddressed | High: migration may be impaired | Add controller election; resolve copies, format, and pricing / counsel and IT | Open: technical confirmation needed |
The review changes the recommendation from routine approval to targeted revision with factual conditions. R1 addresses a potentially delayed trigger, not merely the number of hours. R2 preserves uncertainty rather than inventing subprocessor identities or locations. R3 connects return rights to practical migration costs. Privacy counsel owns applicability analysis; the business owner must obtain access-location facts. None of these three rows resolves the unreviewed security details.
DecoverAI is the Legal Intelligence Platform for litigation and transactions. In its contract review workflow in Word, choose the represented party and supply controller-specific instructions. Findings quote clauses, rank severity, locate text, and identify missing language as not present. Lawyers edit or insert suggestions as ordinary tracked changes in the signed-in Word user’s name and can dismiss findings with reasons. Tabular review supports work across documents; applicability and approval remain counsel’s decisions. Book a demo to discuss applying this workflow to DPA review.
Yes. Review dependencies affecting processing protections, particularly precedence, liability, fees, termination, and security commitments. You need not reopen unrelated terms.
The number alone does not answer the question. Check awareness, without-undue-delay wording, and escalation mechanics against the applicable baseline described in step 5.
Request the applicable version and record an evidence gap. Separately assess contractual authorization and change procedures; the missing list does not establish their adequacy.
A numerical deadline is not itself the Article 28 test. Review election rights, copies, retention exceptions, and practical timing before deciding what additional specificity to negotiate.
Scope: selected EU and California requirements as of October 13, 2026; a general professional workflow, not advice for a particular transaction.
This guide is general information about legal workflows, not legal advice for any matter. It was drafted and reviewed with AI assistance. The worked example is fictional. Contract rights and procedure depend on the governing law, the actual wording, and the facts, so check the cited sources and the rules that apply in your jurisdiction before relying on it.