Template
Vendor data processing agreement checklist
Short answer
Use this checklist when a vendor will process personal data for you and you must review its data processing agreement. It covers the GDPR Article 28(3) required terms plus subprocessors, transfers, security, breach notice, audits, deletion and liability, so gaps are found before signature.
By Pactinel editorial teamReviewed on October 22, 20262 min read
How to use
- Confirm roles first: are you the controller and the vendor your processor? If the vendor also determines purposes, a different analysis applies. See the vendor DPA review guide.
- Work through the table. Mark each item Met, Partly or Missing and note the clause.
- Raise Missing and Partly items with the vendor and record the answers.
- Check the notice clause for how subprocessor or breach notices must be sent, and keep dispatch proof for your own notices (objections, audit requests).
- Diarize subprocessor-change objection windows and DPA review dates.
Checklist
| # | Item | Why it matters | Met / Partly / Missing | Clause |
|---|---|---|---|---|
| 1 | Subject matter, duration, nature and purpose of processing, data types and data subject categories described | Required content of the contract under Article 28(3) | [ ] | [Clause] |
| 2 | Processing only on documented instructions, including for transfers | Article 28(3)(a) | [ ] | [Clause] |
| 3 | Duty of confidentiality on authorized personnel | Article 28(3)(b) | [ ] | [Clause] |
| 4 | Security measures matching Article 32, with an annex that is specific | Article 28(3)(c) | [ ] | [Clause] |
| 5 | Subprocessor rules: authorization (general or specific), list, advance notice of changes, right to object, flow-down of obligations, vendor stays liable | Article 28(2), (3)(d), (4) | [ ] | [Clause] |
| 6 | Help with data subject requests | Article 28(3)(e) | [ ] | [Clause] |
| 7 | Help with security, breach notification, impact assessments and prior consultation | Article 28(3)(f) | [ ] | [Clause] |
| 8 | Personal data breach notice to you without undue delay, with a stated time limit (for example [number] hours) | Lets you meet your own deadlines | [ ] | [Clause] |
| 9 | Deletion or return of data at the end of services, at your choice, with confirmation | Article 28(3)(g) | [ ] | [Clause] |
| 10 | Information to show compliance, and audits or inspections allowed | Article 28(3)(h) | [ ] | [Clause] |
| 11 | Duty to tell you if an instruction appears to infringe data protection law | Article 28(3)(h) | [ ] | [Clause] |
| 12 | International transfers: locations, mechanism relied on, and any further transfers | Transfer rules differ by country | [ ] | [Clause] |
| 13 | Order of precedence between the DPA and the main agreement | Avoids conflicts | [ ] | [Clause] |
| 14 | Limitation of liability for data protection breaches and indemnities: cap, super-cap or exclusions | Commercial risk | [ ] | [Clause] |
| 15 | Term of the DPA linked to the main agreement; surviving obligations | Data may outlive the contract | [ ] | [Clause] |
| 16 | Contact for privacy matters and notices on each side | Operational | [ ] | [Clause] |
Vendor details to record
| Field | Value |
|---|---|
| Vendor legal name | [Vendor legal name] |
| Service and data categories | [Description] |
| Our role / vendor role | [Controller / Processor] |
| Subprocessors (current list link) | [URL or date reviewed] |
| Data locations | [Countries] |
| Next review date | [Date] |
This checklist is general information, not legal advice. Data protection law differs by country and sector; have a qualified privacy lawyer confirm what applies to you.
Pactinel can help you find the data protection clauses in a contract and cite the source text; see the free plan.
Sources
- GDPR Article 28 (processor) · accessed on October 22, 2026