Official skill · Legal basics

Data processing agreement checklist

v1.0.0 · Updated 4 November 2026

Checks a DPA for roles, subprocessors, security measures, breach notice, transfers, deletion, and audits against what your team can actually do. Use it when an enterprise customer sends their DPA with a contract.

Add to my team's pod

Works in Claude, ChatGPT, and coding agents. On Team and Business, the official skill in your pod updates itself when we improve it.

When to use it

An enterprise customer sends their DPA with a contract
You must sign a vendor's data processing addendum

What you give it

DPA and main agreement
Your role with the data
Your hosting, vendors, and incident process

What you get

A rated clause table with a can-we-do-it column, promises still to confirm, and questions for counsel.

How it works

Confirm roles and scope Use the list in GDPR Article 28(3) as the checklist frame: subject matter and duration, nature and purpose, types of personal data, categories of people, and then 8 processor duties (documented instructions, staff confidentiality, security, sub-processor conditions, help with data subject requests, help with security and breach duties, delete or return at the end, information and audits). Find who is named controller and processor. If the roles don't match how the service works (for example, the vendor also uses the data for its own product), mark red and ask counsel.
Check processing on instructions The processor should act only on documented instructions. Note any right the processor keeps to use data for its own purposes (analytics, product improvement, model training): always flag it.
Check subprocessors Is authorization specific or general? Under general authorization, the European Commission's Q&A on its standard clauses says the processor names each sub-processor (categories are not enough), notifies changes in writing, and the parties set the notice period; the controller can object. Check that the DPA says how many days' notice and what happens after an objection. If the user is the processor, compare the list to the user's real vendors; a missing vendor is red.
Check security measures Is there a schedule of technical and organizational measures? Compare each promise to the user's facts. A promise with no matching fact gets "[check: ...]".
Check breach notification Note the deadline exactly as written. The Commission's standard clauses use "without undue delay" and leave a fixed number of hours to the parties, so a hard hour count is a negotiated term. Note what the notice must contain. If the user is the processor and can't meet the deadline today, mark red.
Check transfers Where data goes and which mechanism the DPA names. The Commission's 2021 standard contractual clauses for transfers cover controllers or processors in the EU sending data to ones outside it, and its Q&A says a transfer impact assessment comes before relying on them; check whether one exists. Do not judge whether the mechanism is sufficient: "[ask counsel: is this transfer mechanism adequate for these countries?]".
Check deletion, return, and audits Deletion or return at the end, within how long, and certification. Audit rights: how often, notice, who pays, whether a third-party report can replace an on-site audit. Unlimited on-site audits at the processor's cost are red for a processor.
Check liability and the rest Whether the DPA has its own liability terms or follows the main agreement's cap, indemnities, assistance with data subject requests, and order of precedence. Then write the table, the gaps, and the questions.

Share it with your team

Add it to an AI Skill Pod and everyone on the team, contractors included, uses the same version from their own AI. Read the best ways to share AI skills with a team