Data processing agreement (DPA)

The article prescribes the contents rather than the wording, which is why every vendor’s DPA covers the same eight or nine topics: subject matter and duration, the nature and purpose of processing, categories of data and data subject, processing only on documented instructions, confidentiality of personnel, the security measures of Article 32, the rules for engaging subprocessors, assistance with data-subject rights and breach notification, and deletion or return at the end of the contract.

Because the contents are prescribed, the useful review questions are narrow and specific. Which subprocessors are listed, and is the list the same one in the privacy notice? Is subprocessor authorisation general with notice and a right to object, or specific? What is the breach notification deadline, and does it start on becoming aware? What audit evidence is actually offered — documentation and written answers, or an on-site inspection? And how long after termination is data deleted?

A DPA that is a signable document on the website is a signal in itself. A vendor who requires a negotiation before producing one is telling a buyer something about how long the rest of the procurement will take.