DPA review against the law

Check every Article 28 requirement, with language from your privacy playbook to close each gap.

Where DPAs slow down

Every customer sends its own DPA

Large customers insist on their own processing terms, and no two are the same.

Requirements come from several laws

GDPR, UK GDPR and CCPA ask for different terms in the same agreement.

Security exhibits need engineering

Technical and organizational measures have to match what your systems actually do.

Every Article 28 requirement checked

Proviso checks each requirement in the DPA, cites the article it comes from and suggests a clause from your privacy playbook for anything missing.

See how policy checks work

A DPA checked against GDPR, CCPA and Virginia privacy law, with a missing clause and a suggested fix

Requirements Proviso checks in DPAs

Each check names the article it comes from.

See GDPR in the Trust Center

Instructions

Processing only on the controller’s documented instructions

GDPR Art. 28(3)(a)

Subprocessors

Prior authorization, with the same terms passed down

GDPR Art. 28(2) and 28(4)

Security

Technical and organizational measures for the data processed

GDPR Art. 32

Breach notice

How fast the processor reports a personal data breach

GDPR Art. 33

Deletion

Return or deletion of data at the end of the service

GDPR Art. 28(3)(g)

Marlow Bank checks outsourcing agreements against regulator rules

Outsourcing agreements are checked against the regulator’s rules as well as the bank’s own positions. Twenty-seven were brought into line ahead of the deadline.

Read the story

Outsourcing agreements brought into line

2 weeks

Ahead of the regulator deadline