Last reviewed: October 2026
No Credit Card Required
This free DPA review checklist takes one data processing agreement from a supplier, the processor, through a review by you, the controller, before anyone signs it. It is for privacy teams, in-house lawyers, DPOs and procurement. The business owner describes the data and the people it is about, the privacy reviewer confirms the roles, then checks the processing description and each term Article 28(3) requires, from documented instructions to audits. The security reviewer checks the Article 32 measures. Breach notice timing, sub-processors and the right to object, transfers outside the UK or EEA, and liability follow. Terms that fail go back to the supplier as redlines and come back for a re-review. The DPO or privacy lead signs off before the DPA is signed and added to your records of processing with a review date. Choose UK GDPR, EU GDPR or both on the first task and the matching notes appear. Review the main agreement with the Contract Review & Approval Checklist and the supplier itself with the Vendor Risk Assessment Checklist.
A data processing agreement is the contract the law requires when a supplier processes personal data on your behalf. Article 28(3) of the UK GDPR and the EU GDPR lists what it must say: a description of the processing and eight terms, from documented instructions to audits. Suppliers usually send their own DPA, and most of the work is checking it says what the law needs and nothing that lets the supplier use your data for itself.
This checklist reviews one DPA, as the controller, before you sign it. It does not review the whole commercial contract or decide whether the supplier is safe to use at all; other checklists do that. It is a working checklist, not legal advice: your privacy team and your own advisers decide what your DPA needs.
Covers: the roles, the Article 28(3) description and terms, security, breach notice, sub-processors, transfers, liability, redlines and the DPO’s sign-off.
When: each time a supplier that will handle personal data sends a DPA, and again at renewal.
Output: a signed DPA in your records with a review date.
Covers: intake, risk triage, legal and commercial review, negotiation, approval, signature and filing for any contract.
Use it: for the main agreement the DPA attaches to. Contract Review & Approval Checklist.
Covers: tiering the supplier, inherent risk, security questionnaires and assurance reports, and reassessment.
Use it: before the DPA review, to show the supplier gives sufficient guarantees. Vendor Risk Assessment Checklist.
Nine phases take one DPA from the day it arrives to a signed agreement in your records. The law you choose on the first task (UK GDPR, EU GDPR or both) shows the matching notes on the breach and transfer tasks. The supplier’s own DPA, sensitive data, a supplier that is not a processor, sub-processors, transfers outside the UK or EEA and terms that fail review each add their own tasks. The sign-off is the gate: the signature and the records wait until it is done.
The privacy reviewer starts the run when a supplier’s DPA arrives. Task 1 names the people and the law that applies. Every due date counts in business days from the day the DPA arrived for review.
Article 28 terms are for a processor that acts on your behalf. A supplier that decides why and how the data is used is a controller for that use and needs different terms, so confirm the roles before checking any clause.
Article 28(3) says the contract must set out the subject matter and duration, the nature and purpose, the type of personal data and categories of data subjects, and your obligations and rights. Check each one against what the business owner described in Phase 1.
One task per term the law requires. Record what each clause says and whether it passes. Security and sub-processors have phases of their own.
The supplier must take all the measures Article 32 requires. The security reviewer checks the measures annex and the privacy reviewer checks how fast you hear about a breach. Sensitive data adds a task.
Article 28(2) says the supplier may not engage another processor without your prior specific or general written authorisation. If it uses sub-processors, three tasks check the list, your right to object and the terms that flow down.
A transfer can happen through hosting, support access or a sub-processor abroad. If the data leaves the UK or EEA, three tasks check each destination, the transfer mechanism and the assessment behind it. The notes follow the law chosen on task 1.
Liability caps and indemnities are commercial terms, not legal requirements. Then decide whether the DPA passes. Changes needed adds the redline round and a re-review before the sign-off.
The DPO or privacy lead signs off before anyone signs the DPA. The sign-off is the gate: the signature, the records and the review date wait until it is done.
The middle column is the law, the same in the UK GDPR and the EU GDPR. The right-hand column is common practice when reviewing a supplier’s wording, not a legal requirement.
| Term | What the law requires | What to look for in the DPA |
|---|---|---|
| Description (28(3)) | Subject matter, duration, nature and purpose, types of personal data, categories of data subjects, your obligations and rights | Lists that match the data the supplier will really receive |
| Instructions (28(3)(a)) | Process only on your documented instructions, including for transfers, unless the law requires otherwise | No clause letting the supplier use the data for its own purposes |
| Confidentiality (28(3)(b)) | Everyone authorised to process the data is bound to confidentiality | Covers contractors and temporary staff |
| Security (28(3)(c)) | All measures Article 32 requires | A measures annex specific enough to check |
| Sub-processors (28(2), 28(3)(d), 28(4)) | Your prior specific or general written authorisation; notice of changes and a chance to object; the same obligations flowed down; the supplier stays fully liable | A notice period and a remedy if you object |
| Data subject rights (28(3)(e)) | Help you respond to requests, as far as possible | A response time that fits your own deadline |
| Your obligations (28(3)(f)) | Help with Articles 32 to 36: security, breach notification, DPIAs, prior consultation | Who pays, and how fast |
| End of contract (28(3)(g)) | Delete or return the data at your choice, and delete copies unless the law requires storage | How backups are handled and a deletion confirmation |
| Audits (28(3)(h)) | All information needed to show compliance; allow and contribute to audits and inspections | Limits on notice, frequency and cost |
| Unlawful instructions | Tell you immediately if, in its opinion, an instruction infringes data protection law | A named contact for the warning |
Article 28 reads the same in both. The differences show up in breach reporting and international transfers, and the notes on those tasks follow the law you choose on the first task.
| Point | UK GDPR | EU GDPR |
|---|---|---|
| Processor tells you of a breach | Without undue delay after becoming aware (Article 33(2)) | Without undue delay after becoming aware (Article 33(2)) |
| You tell the regulator | The Information Commission (the ICO), without undue delay and where feasible within 72 hours (Article 33(1)) | The competent supervisory authority, without undue delay and where feasible within 72 hours (Article 33(1)) |
| Countries approved for transfers | UK regulations approving transfers (Article 45A), which the ICO calls adequacy regulations | European Commission adequacy decisions |
| Standard clauses | The ICO’s IDTA, or its Addendum to the EU SCCs; the EU SCCs alone are not valid for UK transfers | The Commission’s standard contractual clauses of 4 June 2021 |
| Assessment with a safeguard | The data protection test: protection not materially lower than under UK law (Article 46(1A) and (6)) | Enforceable data subject rights and effective legal remedies available (Article 46(1)) |
Sources. UK GDPR Article 28, Article 33 and Article 46 on legislation.gov.uk (latest revised version, including the Data (Use and Access) Act 2025 changes), and the EU GDPR as adopted. The ICO’s guidance on contracts between controllers and processors (which it says is under review after the Data (Use and Access) Act) and on international transfers, and the European Commission’s page on standard contractual clauses. ICO guidance is guidance, not law.
Choose the business owner, the privacy reviewer, the security reviewer and the DPO or privacy lead on the first task, and each task is assigned to the person who should do it. Every due date counts in business days from the day the DPA arrived, and overdue alerts go to the people assigned.
The supplier’s own DPA, sensitive data, a supplier that is not your processor, sub-processors, transfers outside the UK or EEA and terms that fail review each add the tasks that deal with them. A simple DPA with none of these stays short.
The DPO’s sign-off is a gate: the signature and the records cannot be ticked off until it is done. The DPA, the sub-processor list and the transfer documents are uploaded to the tasks they belong to, and the Reports Grid lists each review with its answers, with filters and export. See how approval steps work.
CheckFlow does not draft or redline the DPA; your documents and your lawyers do that. CheckFlow runs the review around it: who checks which term by when, what evidence is attached, what failed and who signed off. See analytics and reporting for open and overdue reviews, and how recurring checklists start the next review on time.
Assess the supplier first with the Vendor Risk Assessment Checklist, or the SaaS Procurement Security Review Checklist for a software tool, and review the main agreement with the Contract Review & Approval Checklist. If the data is sensitive, run the Data Protection Impact Assessment (DPIA) Checklist, and test your processor contracts as a whole each year with the GDPR Compliance Audit Checklist.
Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.
It is the contract between a controller and a processor that the UK GDPR and the EU GDPR require when a supplier processes personal data on the controller’s behalf. Article 28(3) says it must be binding on the processor, describe the processing and include a set of required terms. Article 28(9) says it must be in writing, which includes electronic form. Many suppliers call theirs a DPA or a data processing addendum.
The subject matter and duration, the nature and purpose, the types of personal data and categories of data subjects, and your obligations and rights. Then terms that the processor acts only on your documented instructions, binds its people to confidentiality, takes the Article 32 security measures, follows the sub-processor rules, helps with data subject requests and with Articles 32 to 36, deletes or returns the data at the end, and allows audits. It must also tell you if an instruction infringes data protection law.
Article 28 terms are for processors. Joint controllers need an arrangement under Article 26 that sets out each party’s responsibilities, and people can exercise their rights against either of them. A supplier that uses the data for its own purposes is a separate controller for that use, which usually calls for data sharing terms instead. The checklist adds a task for this when the roles step says the supplier is not your processor.
Article 33(2) says without undue delay after it becomes aware of the breach. It sets no number of hours. Your own duty is to tell the regulator without undue delay and, where feasible, within 72 hours of becoming aware, so many controllers agree a fixed number of hours in the DPA that leaves room for that. The figure is a commercial choice, not a legal one.
That the supplier cannot use one without your prior specific or general written authorisation, and that under a general authorisation it tells you of any intended addition or replacement so you can object (Article 28(2)). Also that it puts the same data protection obligations on each sub-processor by contract and stays fully liable to you for them (Article 28(4)). Get the current list and check where each one processes the data.
Only if the data is transferred to, or accessed from, a country outside the UK or EEA that is not covered by adequacy. For UK transfers the ICO’s IDTA or its Addendum to the EU standard contractual clauses are the usual safeguards; the ICO says the EU SCCs alone are not valid for UK transfers. For EU transfers, the Commission’s 2021 standard contractual clauses. With a safeguard you also need an assessment of the destination: in the UK, the data protection test.
The law does not say who signs off inside your organisation. This checklist makes the DPO or privacy lead the gate, because they can judge the data protection risk, and leaves the signature to someone authorised to sign contracts for you. The business owner decides commercial points such as liability caps, and the privacy reviewer the data protection ones.
Yes, if you keep a record under Article 30. A controller’s record includes the categories of recipients and any transfers to other countries, naming each country. Under the UK GDPR, Article 30(5) exempts organisations with fewer than 250 employees unless the processing is likely to result in a risk, is not occasional, or includes special category or criminal offence data.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
14-day free trial, no credit cardFull refund in your first 30 daysUS hosting, EU on request
