Reviewing a vendor's DPA: the clauses that matter

This guide is for in-house counsel and privacy leads reviewing a vendor's standard data processing agreement before signing. Whether a DPA is needed at all, and the terms each law requires side by side, are covered in Do you need a DPA? For an AI tool or an API, read this guide with DPAs with AI vendors.

Who is really the processor?

The label in the contract does not decide the role; what the vendor does with the data does. The controller determines the purposes and means of the processing, and the processor processes personal data on the controller's behalf (GDPR Article 4(7) and (8)). A processor that determines the purposes and means itself is a controller for that processing (Article 28(10)).

So a vendor that uses your data for its own purposes (product improvement, analytics, training) is a controller for that use, and the DPA cannot change that by calling it a processor. Where the vendor's terms allow such a use, decide whether you accept it or ask for it to be removed.

Under the CCPA, the question is whether the vendor qualifies as a service provider or contractor, or is a third party. A third party receiving personal information from you can make the transfer a sale or sharing. The terms that make a vendor a service provider or contractor are under "The CCPA terms" below.

Scope and instructions

Article 28(3) requires the contract to set out the subject matter and duration of the processing, its nature and purpose, the types of personal data and the categories of data subjects. These details usually sit in an annex. Check that it is filled in for your use, not left generic: it describes what you are authorizing, and it is the measure for the vendor's later use of the data.

Under Article 28(3)(a), the vendor acts only on your documented instructions. Watch for "and to improve our services" or similar language that widens the purpose. Each such phrase adds a purpose of the vendor's own, and brings back the question above.

Sub-processors

A processor may engage another processor only with the controller's prior written authorization, specific or general (Article 28(2)). Vendor DPAs almost always ask for general authorization. That is workable only with what Article 28(2) attaches to it: notice of changes and a real right to object. A notice that leaves you only the choice of accepting or terminating should be negotiated.

Ask for the current list and the notice period for changes (30 days is common), and require that the same obligations flow down to each sub-processor (Article 28(4)), with the vendor liable to you for them.

Breach notice

You have 72 hours from becoming aware of a breach to notify the supervisory authority (Article 33(1)); the processor must tell you "without undue delay" (Article 33(2)). On their own the two do not fit: a vendor that takes three days to tell you leaves you no time.

Ask for a fixed window (24 or 48 hours) and a minimum content for the notice (what happened, the data and people affected, the measures taken, a contact), so you can meet your own deadline.

Audits and assistance

Article 28(3)(h) requires the vendor to make available the information needed to demonstrate compliance and to allow audits, including inspections. Vendors usually offer certifications and reports instead (SOC 2, ISO 27001). Accept them as a first step, and keep a right to audit when there is cause, for example after a breach.

Article 28(3)(e) and (f) require the vendor to help with data subject requests, security, breach notice and impact assessments. Vendor DPAs often say "at the customer's cost" with no time frame. Check who pays and how fast: help that arrives after your own deadline is of little use.

Deletion or return at the end

Article 28(3)(g) requires the vendor to delete or return all personal data at the end of the service, at your choice, unless the law requires keeping it. Many DPAs repeat the rule without saying when. Ask for a time limit (30 to 90 days), for what happens to backups, and for a written confirmation.

Liability

Standard vendor caps often treat a data breach like any other claim, under the same general cap as a missed service level. Consider a separate, higher cap for data protection breaches, and exclude fines and regulatory costs from the general cap where you can.

Read the DPA's liability clause with the main agreement, and check that it does not override the main agreement in the vendor's favor (for example, by bringing claims under the DPA within a lower cap).

International transfers

Where personal data leaves the European Economic Area, Chapter V of the GDPR applies. The transfer needs an adequacy decision (for the United States, the EU-US Data Privacy Framework, which covers only certified US companies), or the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two, or Module Three where you are yourself a processor) with a transfer impact assessment.

Check that sub-processors outside the EEA are covered too: the DPA should say which transfer tool applies to each. See also EU data transfers after the Data Privacy Framework.

Sources: GDPR, Regulation (EU) 2016/679, EUR-Lex; Commission Implementing Decision (EU) 2021/914 (Standard Contractual Clauses), EUR-Lex; Data Privacy Framework program.

The CCPA terms

The CCPA requires a written contract with each service provider or contractor (Cal. Civ. Code § 1798.100(d) and § 1798.140), with the terms set out in the CCPA regulations (Cal. Code Regs., tit. 11, § 7051):

• the specified business purposes;
• no selling or sharing of the personal information;
• no use outside the direct business relationship;
• no combining with personal information from other sources, except as the regulations permit;
• notice to you if the provider can no longer comply;
• your right to take reasonable steps to stop and remedy unauthorized use.

DPAs written for the GDPR often leave some of these out, and without them the vendor is not a service provider or contractor. One DPA can carry both the GDPR and the CCPA terms.

Sources: CCPA, Civil Code § 1798.100 et seq., as in force on 1 January 2026 (CPPA); CCPA Regulations, § 7051 (CPPA).

Need a first draft now? Dealroom, built by our affiliated technology company, generates a DPA under the GDPR and the CCPA. Drafting is free, and we can review the result →

Checklist

• Role decided on what the vendor does with the data, not on the label
• Vendor's own use of the data (product improvement, analytics, training) removed, or identified and accepted
• Annex filled in for your use; processing only on documented instructions, with no wording that widens the purpose
• Sub-processor list, notice period and a real right to object; same obligations flowed down, vendor liable for them
• Breach notice within a fixed window (24 or 48 hours), with a minimum content
• Certifications and reports first, and a right to audit when there is cause
• Assistance duties: who pays, and how fast
• Deletion or return within a time limit, backups covered, written confirmation
• Separate, higher cap for data protection breaches; fines and regulatory costs outside the general cap; no override of the main agreement in the vendor's favor
• Transfer tool for the vendor and for each sub-processor outside the EEA
• CCPA service provider or contractor terms included

Questions people ask

Can the DPA make the vendor a processor? No. The role follows what the vendor does with the data. A vendor that uses it for its own purposes is a controller for that use, whatever the DPA says.

Is a SOC 2 report or an ISO 27001 certificate enough instead of audit rights? It is a reasonable first step, but Article 28(3)(h) requires the vendor to allow audits. Keep a right to audit when there is cause.

What breach notice period should we ask for? A fixed window of 24 or 48 hours, with a minimum content, so that you can meet your own 72-hour deadline to notify the supervisory authority.

Do we need separate DPAs for the GDPR and the CCPA? No. One DPA can carry both sets of terms.

Update log

• 29 October 2026: first published.