https://maigon.ai/assets/GdprDpaGuide-Bb3I35jv.js

1import{j as e,a1 as t,B as n}from"./index-DuPzfAWx.js";import{A as m}from"./ArticleHeader-BFRkKyZ2.js";import{F as u}from"./Footer-ClEGmW6P.js";import{S as p}from"./SEO-o1G8mjQT.js";import{b as g,g as x,c as b,d as D,S as f}from"./StructuredData-DPTQkzbA.js";import"./SiteHeader-Bm-3l6V7.js";import"./Logo-9g9nzmtd.js";import"./LocalizedLink-Cns-yZwL.js";import"./LanguageToggle-CuNIQMqZ.js";import"./MobileNavigation-BX46y3u3.js";import"./chevron-down-5elweiHh.js";function q(){const i="/public-articles/gdpr-dpa-guide",o="/og-images/gdpr-dpa-guide.jpg",a="/og-images/gdpr-dpa-guide-og.jpg",l=g({name:"Maigon",url:"/",logo:"/maigon-logo_5.png"}),c=x({headline:"GDPR DPA Review Checklist: How to Review a Data Processing Agreement",description:"A practical GDPR DPA review checklist for legal and privacy teams covering Article 28 clauses, processor obligations, subprocessors, transfers, breach notice, audits, and common drafting gaps.",url:i,image:a,datePublished:"2026-04-15",dateModified:"2026-05-12",authorName:"Maigon",publisherL

1ogo:"/maigon-logo_5.png"}),r=[{question:"What is a Data Processing Agreement under the GDPR?",answer:"A Data Processing Agreement is a contract between a controller and processor that sets out how personal data may be processed, protected, returned, deleted, audited, and handled under Article 28 of the GDPR."},{question:"What should a GDPR DPA review checklist include?",answer:"A GDPR DPA review checklist should cover processing instructions, confidentiality, security measures, subprocessors, international transfers, data subject rights support, breach assistance, deletion or return, audit rights, and complete processing annexes."},{question:"What are common DPA red flags?",answer:"Common DPA red flags include vague processing instructions, missing annexes, weak breach notification timelines, unclear transfer mechanisms, unilateral subprocessor changes, processor-controlled deletion language, and audit rights that are too narrow to use."},{question:"Can AI help review DPAs?",answer:"AI can help with first-pass DPA review by identifying missing Article 28 clauses, incomplete annexes, breach notification gaps, subprocessor issues, transfer language, and unusual drafting positions. Privacy and legal teams should still make the final judgment."}],d=b(r),h=D([{name:"Home",url:"/"},{name:"Articles",url:"/news"},{name:"GDPR DPA Guide",url:i}]);return e.jsxs("div",{className:"min-h-screen bg-[#F9F8F8]",children:[e.jsx(p,{title:"GDPR DPA Review Checklist: How to Review a Data Processing Agreement",description:"A practical GDPR DPA review checklist for legal and privacy teams covering Article 28 clauses, processor obligations, subprocessors, transfers, breach notice, audits, and common drafting gaps.",canonicalPath:i,ogImage:a,ogImageAlt:"Reviewing a GDPR Data Processing Agreement",ogType:"article"}),e.jsx(f,{data:[l,h,c,d]}),e.jsx(m,{}),e.jsx("article",{className:"pt-24 lg:pt-32 pb-16",children:e.jsxs("div",{className:"max-w-4xl mx-auto px-4 sm:px-8 lg:px-16",children:[e.jsxs("header",{className:"mb-12",children:[e.jsxs("div",{className:"flex items-center gap-2 text-sm text-[#271D1D]/60 mb-4",children:[e.jsx("span",{children:"Published"}),e.jsx("span",{children:"•"}),e.jsx("span",{children:"Apr 15, 2026"}),e.jsx("span",{children:"•"}),e.jsx("span",{children:"10 min read"})]}),e.jsx("h1",{className:"text-4xl lg:text-5xl font-medium text-[#271D1D] font-lora leading-tight mb-6",children:"GDPR DPA Review Checklist: How to Review a Data Processing Agreement"}),e.jsx("p",{className:"text-xl text-[#271D1D]/70 leading-relaxed",children:"Every vendor relationship that involves personal data needs a serious DPA review. Here is the GDPR checklist legal and privacy teams should use before signing."})]}),e.jsx("div",{className:"mb-12",children:e.jsx("img",{src:o,alt:"Reviewing a GDPR Data Processing Agreement",className:"w-full h-64 lg:h-96 object-cover rounded-lg"})}),e.jsxs("div",{className:"prose prose-lg max-w-none",children:[e.jsx("p",{className:"text-[#271D1D]/80 leading-relaxed mb-6",children:'Under the GDPR, any organisation that shares personal data with a third-party processor must have a written Data Processing Agreement (DPA) in place. Article 28 sets out the minimum content that DPA must contain. In practice, however, many DPAs circulated by vendors either omit required provisions, water down processor obligations, or leave key details — like the list of sub-processors — in a perpetually "to be confirmed" state.'}),e.jsx("p",{className:"text-[#271D1D]/80 leading-relaxed mb-6",children:"Privacy teams and in-house counsel reviewing DPAs at scale need a consistent framework. This guide walks through the Article 28 requirements and the additional clauses that determine whether a DPA actually protects your organisation."}),e.jsxs("div",{className:"bg-white rounded-lg p-6 border border-[#271D1D]/10 mb-8",children:[e.jsx("p",{className:"text-sm font-semibold text-[#9A7C7C] uppercase tracking-wide mb-3",children:"Quick answer"}),e.jsx("p",{className:"text-[#271D1D]/80 leading-relaxed mb-4",children:"A GDPR DPA review should confirm that the agreement contains the mandatory Article 28 terms, describes the processing clearly, controls subprocessors and transfers, gives usable breach and audit rights, and lets the controller choose deletion or return of personal data at the end of the services."}),e.jsxs("ul",{className:"list-disc pl-6 space-y-2 text-[#271D1D]/80",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Must-have terms:"})," documented instructions, confidentiality, security, assistance, audits, and deletion or return."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"High-risk gaps:"})," blank annexes, vague security measures, weak breach timelines, and unilateral subprocessor changes."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Review goal:"})," confirm the DPA is operationally usable, not just GDPR-themed."]})]})]}),e.jsx("h2",{className:"text-2xl font-medium text-[#271D1D] font-lora mb-4 mt-8",children:"The Article 28 Mandatory Provisions"}),e.jsx("p",{className:"text-[#271D1D]/80 leading-relaxed mb-4",children:"A compliant DPA must set out that the processor:"}),e.jsxs("ul",{className:"list-disc pl-6 mb-6 space-y-2 text-[#271D1D]/80",children:[e.jsx("li",{children:"Processes personal data only on documented instructions from the controller"}),e.jsx("li",{children:"Ensures that persons authorised to process the data are under a duty of confidentiality"}),e.jsx("li",{children:"Implements appropriate technical and organisational security measures (Article 32)"}),e.jsx("li",{children:"Engages sub-processors only with the controller's prior written consent and under a contract that imposes equivalent obligations"}),e.jsx("li",{children:"Assists the controller in responding to data subject rights requests"}),e.jsx("li",{children:"Assists the controller in meeting its obligations under Articles 32–36 (security, breach notification, DPIAs)"}),e.jsx("li",{children:"At the controller's choice, deletes or returns all personal data on termination"}),e.jsx("li",{children:"Makes available all information necessary to demonstrate compliance and allows audits"})]}),e.jsxs("div",{className:"bg-[#F5ECE9] rounded-lg p-6 mb-6 border-l-4 border-[#9A7C7C]",children:[e.jsx("p",{className:"text-sm font-semibold text-[#9A7C7C] uppercase tracking-wide mb-2",children:"Common gap"}),e.jsx("p",{className:"text-[#271D1D]/80 text-sm leading-relaxed",children:"The deletion or return obligation is frequently drafted as processor's choice rather than controller's choice. This matters: if a breach occurs and you need data destroyed immediately, a clause giving the processor discretion is useless."})]}),e.jsx("h2",{className:"text-2xl font-medium text-[#271D1D] font-lora mb-4 mt-8",children:"GDPR DPA review checklist"}),e.jsx("p",{className:"text-[#271D1D]/80 leading-relaxed mb-6",children:"When reviewing a Data Processing Agreement, use a checklist that tests both legal completeness and operational usefulness:"}),e.jsx("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-4 mb-6",children:["Does the DPA clearly identify the controller, processor, processing purpose, data categories, and data subjects?","Does the processor process personal data only on documented controller instructions?","Are c

1onfidentiality obligations imposed on everyone authorised to process the data?","Are technical and organisational measures specific enough to evaluate?","Are subprocessors listed, controlled, and subject to advance notice or objection rights?","Are international transfers supported by an adequacy decision, SCCs, or another transfer mechanism?","Is breach notice fast enough for the controller's 72-hour GDPR timeline?","Can the controller choose deletion or return of personal data at termination?","Are audit rights usable in practice, including fallback rights beyond standard reports?","Does the processor assist with data subject rights, DPIAs, security, and regulator requests?"].map(s=>e.jsx("div",{className:"rounded-lg border border-[#271D1D]/10 bg-white p-4",children:e.jsx("p",{className:"text-sm leading-relaxed text-[#271D1D]/75",children:s})},s))}),e.jsx("h2",{className:"text-2xl font-medium text-[#271D1D] font-lora mb-4 mt-8",children:"Annex Requirements: The Details That Are Frequently Missing"}),e.jsx("p",{className:"text-[#271D1D]/80 leading-relaxed mb-6",children:"The GDPR and standard contractual clauses require the DPA to be supplemented with specific annexes describing the processing activity. These are often left blank or filled in with vague descriptions. Check that the DPA includes:"}),e.jsxs("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-6 mb-6",children:[e.jsxs("div",{className:"bg-white rounded-lg p-6 border border-[#271D1D]/10",children:[e.jsx("h4",{className:"font-medium text-[#271D1D] mb-3",children:"Annex I — Processing description"}),e.jsxs("ul",{className:"text-sm text-[#271D1D]/70 space-y-2",children:[e.jsx("li",{children:"• Categories of data subjects"}),e.jsx("li",{children:"• Categories of personal data"}),e.jsx("li",{children:"• Nature and purpose of processing"}),e.jsx("li",{children:"• Duration of processing"})]})]}),e.jsxs("div",{className:"bg-white rounded-lg p-6 border border-[#271D1D]/10",children:[e.jsx("h4",{className:"font-medium text-[#271D1D] mb-3",children:"Annex II — Technical and organisational measures"}),e.jsxs("ul",{className:"text-sm text-[#271D1D]/70 space-y-2",children:[e.jsx("li",{children:"• Encryption standards"}),e.jsx("li",{children:"• Access control and pseudonymisation"}),e.jsx("li",{children:"• Business continuity / recovery"}),e.jsx("li",{children:"• Testing and audit regimes"})]})]})]}),e.jsx("h2",{className:"text-2xl font-medium text-[#271D1D] font-lora mb-4 mt-8",children:"Sub-Processor Management"}),e.jsx("p",{className:"text-[#271D1D]/80 leading-relaxed mb-6",children:"Sub-processor clauses are where most commercial DPAs fall short of what controllers actually need. Watch for:"}),e.jsxs("ul",{className:"list-disc pl-6 mb-6 space-y-2 text-[#271D1D]/80",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Blanket consent vs. specific consent"})," — some vendors bury a list of pre-approved sub-processors in a URL that can be updated without notice. This is technically permissible under GDPR if accompanied by a change notification mechanism, but the notification periods offered are often too short (e.g., 5 days) to allow meaningful objection."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Sub-processor flow-down"})," — the processor must impose equivalent obligations on sub-processors. Check whether the DPA includes any mechanism to verify this, or merely asserts it."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"International transfers"})," — where sub-processors are located outside the EEA, the DPA or its annexes must document the transfer mechanism (adequacy decision, SCCs, etc.)."]})]}),e.jsx("blockquote",{className:"border-l-4 border-[#9A7C7C] pl-6 my-8 italic text-[#271D1D]/80",children:'"A DPA that defers sub-processor disclosure to a webpage the vendor controls unilaterally is a DPA that protects the vendor, not the controller."'}),e.jsx("h2",{className:"text-2xl font-medium text-[#271D1D] font-lora mb-4 mt-8",children:"Breach Notification Timelines"}),e.jsx("p",{className:"text-[#271D1D]/80 leading-relaxed mb-6",children:"The GDPR requires controllers to notify supervisory authorities within 72 hours of becoming aware of a personal data breach. For that timeline to be achievable, you need your processor to notify you significantly faster. Check:"}),e.jsxs("ul",{className:"list-disc pl-6 mb-6 space-y-2 text-[#271D1D]/80",children:[e.jsx("li",{children:'Does the DPA specify a processor notification period? (Best practice: 24–48 hours; avoid "without undue delay" with no timeframe)'}),e.jsx("li",{children:"What information must be included in the initial notification?"}),e.jsx("li",{children:"Is there an obligation to provide updates as more information becomes available?"}),e.jsx("li",{children:"Does the processor have any obligation to assist in the notification to the supervisory authority and to affected data subjects?"})]}),e.jsx("h2",{className:"text-2xl font-medium text-[#271D1D] font-lora mb-4 mt-8",children:"Audit Rights"}),e.jsx("p",{className:"text-[#271D1D]/80 leading-relaxed mb-6",children:"Article 28 requires processors to allow for and contribute to audits. In practice, many processor DPAs replace direct audit rights with a right to re

1ceive third-party audit reports (e.g., SOC 2, ISO 27001). This is commercially reasonable but check whether:"}),e.jsxs("ul",{className:"list-disc pl-6 mb-6 space-y-2 text-[#271D1D]/80",children:[e.jsx("li",{children:`The report sharing is genuinely available on request (not just "upon reasonable request at the vendor's discretion")`}),e.jsx("li",{children:"The controller retains a fallback right to conduct a direct audit if the report does not adequately address a specific concern"}),e.jsx("li",{children:"Any costs associated with audits are addressed — one-sided clauses requiring the controller to bear all audit costs can be prohibitive"})]}),e.jsx("h2",{className:"text-2xl font-medium text-[#271D1D] font-lora mb-4 mt-8",children:"Common DPA red flags"}),e.jsx("p",{className:"text-[#271D1D]/80 leading-relaxed mb-6",children:"A DPA can look GDPR-compliant while still creating practical risk. These are the issues that should trigger deeper legal or privacy review:"}),e.jsxs("ul",{className:"list-disc pl-6 mb-6 space-y-2 text-[#271D1D]/80",children:[e.jsx("li",{children:"The processing description is generic enough to cover almost any use of personal data."}),e.jsx("li",{children:'The security annex says "industry standard measures" without naming actual controls.'}),e.jsx("li",{children:"The processor can change subprocessors by updating a webpage with little or no notice."}),e.jsx("li",{children:"International transfer language refers to SCCs but does not identify the relevant module or transfer scenario."}),e.jsx("li",{children:'Breach notice is limited to "without undue delay" with no practical deadline.'}),e.jsx("li",{children:"Audit rights are replaced entirely by reports selected by the processor."}),e.jsx("li",{children:"Deletion or return is drafted as the processor's choice rather than the controller's choice."})]}),e.jsx("h2",{className:"text-2xl font-medium text-[#271D1D] font-lora mb-4 mt-8",children:"Reviewing DPAs at Scale"}),e.jsx("p",{className:"text-[#271D1D]/80 leading-relaxed mb-6",children:"Privacy teams in organisations with many vendor relationships often review dozens of DPAs per year. The mandatory Article 28 provisions are rule-based enough that AI tools can flag missing or incomplete clauses reliably — checking whether the deletion obligation favours controller or processor, whether annex fields are populated, whether breach notification timelines are specified. This frees reviewers to focus on the genuinely fact-specific analysis: whether the described security measures are adequate for the sensitivity of the data being processed."}),e.jsx("h2",{className:"text-2xl font-medium text-[#271D1D] font-lora mb-4 mt-8",children:"FAQ: GDPR DPA review"}),e.jsx("div",{className:"space-y-4 mb-8",children:r.map(s=>e.jsxs("div",{className:"bg-white rounded-lg p-5 border border-[#271D1D]/10",children:[e.jsx("h3",{className:"font-medium text-[#271D1D] mb-2",children:s.question}),e.jsx("p",{className:"text-[#271D1D]/75 leading-relaxed",children:s.answer})]},s.question))}),e.jsx("h2",{className:"text-2xl font-medium text-[#271D1D] font-lora mb-4 mt-8",children:"Related contract review guides"}),e.jsx("p",{className:"text-[#271D1D]/80 leading-relaxed mb-6",children:"DPA risk often interacts with jurisdiction, clause evidence, and broader review workflow. These guides are useful follow-ups:"}),e.jsxs("ul",{className:"list-disc pl-6 mb-6 space-y-2 text-[#271D1D]/80",children:[e.jsx("li",{children:e.jsx(t,{to:"/public-articles/governing-law-jurisdiction",className:"text-[#9A7C7C] underline-offset-4 hover:underline",children:"Governing law and jurisdiction clauses: what to check in contracts"})}),e.jsx("li",{children:e.jsx(t,{to:"/public-articles/a-step-by-step-guide-to-contract-clause-evaluation",className:"text-[#9A7C7C] underline-offset-4 hover:underline",children:"A step-by-step guide to contract clause evaluation"})}),e.jsx("li",{children:e.jsx(t,{to:"/solutions/gdpr-dpa-review",className:"text-[#9A7C7C] underline-offset-4 hover:underline",children:"Explore Maigon's GDPR DPA review workflow"})})]})]}),e.jsx("div",{className:"mt-16 text-center",children:e.jsxs("div",{className:"bg-white rounded-lg p-8 border border-[#271D1D]/10",children:[e.jsx("h3",{className:"font-lora text-2xl font-medium text-[#271D1D] mb-4",children:"Review DPAs in minutes, not hours"}),e.jsx("p",{className:"text-[#271D1D]/70 mb-6",children:"Maigon checks your DPAs against GDPR Article 28 requirements automatically — flagging missing clauses and one-sided provisions before you sign."}),e.jsxs("div",{className:"flex flex-col sm:flex-row gap-4 justify-center",children:[e.jsx(t,{to:"/signin",children:e.jsx(n,{className:"bg-[#9A7C7C] hover:bg-[#9A7C7C]/90 text-white px-8 py-3",children:"Start Free Trial"})}),e.jsx(t,{to:"/solutions",children:e.jsx(n,{variant:"outline",className:"text-[#271D1D] border-[#271D1D]/20 px-8 py-3",children:"Explore AI Solutions"})})]})]})})]})}),e.jsx(u,{})]})}

1export{q as default};