The situation
A vendor’s data processing agreement, uploaded
A Vienna insurance broker’s finance team is onboarding a new expense-management tool. The vendor, based in Dublin, sends its standard data processing agreement and wants a signature this week. Finance owns the contract. The data protection officer works part-time and has asked finance to check the DPA against Article 28 before it reaches her.
The DPA is twelve pages and the security annex another eight. Every clause looks reasonable on its own. The question is whether each required element is there, whether the sub-processor and transfer terms work for the company, and what to send back. That comparison is where the afternoon goes.
What the research has to settle
The rules behind the answer
- Article 28 lists the required content
- Processing only on documented instructions, confidentiality of the people processing, security measures, conditions for sub-processors, help with data-subject requests and with security and impact assessments, deletion or return at the end, and the information and audits needed to show compliance.
- Sub-processors need authorisation
- The processor may engage another processor only with the controller’s prior specific or general written authorisation. Under general authorisation, the controller must be told of changes and be able to object, and the same obligations pass down the chain.
- Transfers outside the EEA are a separate check
- If the vendor or its sub-processors process data outside the EEA, the GDPR’s transfer rules apply: an adequacy decision, standard contractual clauses or another transfer tool. The DPA should say where the data is processed.
- Watch for the vendor’s own purposes
- A processor acts only on the controller’s instructions. A clause letting the vendor use customer data for its own purposes, such as improving its product, raises the question whether it acts as a controller for that use.
How it runs in azta
From the question to the document
The question, as you would type it
Attached is a vendor DPA for an expense-management tool. Check it against Article 28(3) GDPR. Does the sub-processor clause give us a real right to object, and is the clause allowing use of our data for service improvement compatible with the vendor acting as processor?
You start with
A vendor’s data processing agreement, uploaded
- 01
Upload the DPA and annexes
Add the DPA, the security annex and the sub-processor list. azta reads them and refers back to the clause behind each finding.
File upload· Pro - 02
Check each element
Ask azta to check the DPA against Article 28. It cites the GDPR, the EDPB guidelines on controllers and processors and the Court of Justice decisions it holds.
Cited research· Free - 03
Draft the checklist
Ask for a table: element, clause, present or missing, suggested change. Edit it in Canvas.
Canvas · Ask azta· Pro - 04
Send it back as Word
Export the checklist and the suggested changes to Word for the vendor and the DPO.
Word export· Pro You send
A checklist against Article 28 GDPR, with gaps and suggested changes
What you get
A checklist against Article 28 GDPR, with gaps and suggested changes
Checklist · draft
Expense tool DPA: Article 28 check
Present and adequate. Documented instructions (clause 3), confidentiality of staff (clause 5), security measures (Annex 2), help with data-subject requests (clause 7), and deletion or return at the end of the service (clause 11).
Gaps. The sub-processor clause gives notice of changes but no right to object. Ask for an objection window and a right to terminate if an objection is not resolved. The audit clause limits audits to the vendor’s own certifications; ask for a right to audit where those do not answer a specific question.
Question for the DPO. Clause 4.2 lets the vendor use customer data to improve its services. For that use the vendor may be acting as a controller. Either strike the clause or limit it to aggregated, anonymised data, and record the decision.
Outcomes on your numbers
What azta is worth on this task
Pro pays for itself after
21 minutes a month
At €80 an hour, that is all the time Pro (€27 a month) has to take off your desk to cover its price.
Example figures. Replace them with your own.
- Hours back a year
- 22
- Capacity at your rate
- €1,728
- More vendor DPA checks a quarter
- 2.2
- Return on Pro
- 5.3×
- Research
- Drafting
- Your review
A scenario you set, not a promise. The hours that come back go to another client, or deeper into this one.
Want these numbers on your team’s real workload?
Book a demoWhat stays with you
- Negotiating the changes with the vendor.
- The DPO’s sign-off and the record of processing.
- Assessing the vendor’s actual security, which the contract only describes.
Frequently asked questions
- Does this replace our DPO’s review?
- No. It prepares the review: the checklist, the gaps and the citations. The DPO decides what to accept.
- Does azta hold national data protection authority guidance?
- azta holds the GDPR, Court of Justice case law and EDPB material, but not every national authority’s guidance. The source register lists what is included.
- Can we reuse the checklist for the next vendor?
- Yes. Ask for the same structure next time. On Enterprise, save it as a firm template so every check starts from the same format.
