How to review a vendor DPA (GDPR Article 28)

At a glance

Why the DPA is a contract to track, not just sign

A DPA is attached to a commercial agreement, but it has its own life: the subprocessor list changes, the vendor updates its terms, and a transfer mechanism can lapse or be replaced. Treat the DPA as a document linked to the main contract, with its own review date and owner. A vendor relationship can renew automatically while the DPA behind it no longer matches what the vendor actually does.

Step 1: confirm the roles

GDPR distinguishes a controller, which decides the purposes and means of processing, from a processor, which processes on the controller's behalf. A vendor who determines its own purposes for your data, for example by using it to improve its own products, risks being treated as a controller for that processing under Article 28(10). Ask what the vendor does with your data besides providing the service. If the answer includes its own purposes, the agreement is not a plain processor agreement and needs a different review.

Step 2: check the mandatory terms

Article 28(3) requires the processing to be governed by a contract that sets out the subject matter and duration, the nature and purpose, the type of personal data and the categories of data subjects, and the controller's obligations and rights. As of October 2026 the Article's text requires the contract to stipulate that the processor:

1. processes personal data only on the controller's documented instructions, including for transfers to a third country, unless law requires otherwise, in which case it informs the controller first unless the law prohibits that;
2. ensures that authorized persons are committed to confidentiality;
3. takes all measures required under Article 32 on security;
4. respects the conditions for engaging another processor;
5. helps the controller respond to data subject requests;
6. helps the controller with security, breach notification and impact assessments under Articles 32 to 36;
7. at the controller's choice deletes or returns all personal data after the services end and deletes existing copies unless law requires storage; and
8. makes available the information needed to show compliance, allows audits including inspections, and tells the controller immediately if it believes an instruction infringes data protection law.

A vendor DPA that omits any of these has a gap. A DPA that includes them in generic words, such as "appropriate security measures" with no description, is formally present but gives you little to rely on. Ask for a technical and organizational measures annex that describes controls specifically.

Step 3: subprocessors

Article 28(2) requires prior specific or general written authorization before the processor engages another processor. Under general authorization the processor must inform the controller of intended additions or replacements and give it the opportunity to object. Article 28(4) requires the same data protection obligations to be imposed on the subprocessor by contract, and the initial processor remains fully liable to the controller for the subprocessor's performance.

Check:

• Is there a current list of subprocessors, with location and function?
• How will you be told of changes, and how many days do you have to object?
• What happens if you object: termination right, refund, or nothing?
• Does the vendor commit to flow down equivalent terms?

Put the objection window in your calendar. A notice you read after the window closes is a notice you cannot act on.

Step 4: audits and information

Article 28(3)(h) requires the processor to allow for and contribute to audits. Vendors often replace this with a third-party report. A report can satisfy part of the need, but read what it covers and ask what your audit right is if the report is not enough. State a reasonable notice period and scope, and who pays.

Step 5: breach notification

The DPA should say how quickly the vendor tells you about a personal data breach and what it must include. GDPR sets duties for the controller, and the processor's help is part of Article 28(3)(f). Ask for a specific time commitment, such as a number of hours, and a named contact. Check your own regulatory notification duties and make sure the vendor's timing lets you meet them.

Step 6: deletion and return

Check the format and timing of return, the deletion period, and how backups are handled. "Deletion on request" with no deadline is weak. Also check what happens on termination for non-payment.

Step 7: international transfers

If personal data leaves the EU or EEA, you need a transfer mechanism. The European Commission issued modernized standard contractual clauses on 4 June 2021 under Decision 2021/914 for transfers from controllers or processors subject to the GDPR to controllers or processors outside the EU or EEA that are not subject to it. The clauses are organized in four modules: controller to controller, controller to processor, processor to processor and processor to controller. A separate Decision, 2021/915 of the same date, sets out standard clauses for the controller-processor relationship itself under Article 28(7). Do not confuse the two: one covers the Article 28 terms, the other covers transfers. The Commission page notes that the modernized clauses replace three earlier sets adopted under the old Data Protection Directive.

Ask where data is stored, where support staff access it from, and which entities receive it. A vendor can store data in the EU and still transfer it through remote access.

Where the law differs

This table is general information, not legal advice.

Review workflow

1. Collect the vendor's DPA, annexes, subprocessor list and security documents.
2. Fill a checklist (the vendor DPA checklist template covers the points above).
3. Mark each requirement as met, partly met or missing, with the clause reference.
4. Negotiate the gaps that matter, in order of risk.
5. Record the signed version, effective date and review date.
6. Calendar the subprocessor objection windows and renewal dates.
7. Repeat the review when the vendor changes terms or the services change.

Common failures

• A vendor DPA on its own paper that conflicts with your master agreement. Check the order-of-precedence clause.
• No annex. The description of processing and security measures are in the annexes; an agreement without them is incomplete.
• Subprocessor list on a web page that changes. Record the version you reviewed.
• Transfers ignored. Storage location is not the same as access location.
• No owner. Someone must receive subprocessor notices.

How Pactinel helps

Pactinel records data processing agreements as documents linked to the main contract, with dates and owners, and can raise alerts when a document your rules require, such as a current DPA, is missing or expired. Clause search finds contracts that contain data protection terms, and AI can propose clause extracts with a link to the source text for a person to confirm. Pactinel does not give legal advice and does not decide whether a DPA complies with the law. You can start on the free plan.