The situation
A customer’s data processing agreement, uploaded
A Lisbon-based company selling HR software is onboarding a large logistics customer. The customer’s privacy team sent its own data processing agreement: 24-hour breach notice, prior approval of every new sub-processor, unlimited on-site audits, deletion within 48 hours of termination, and uncapped liability for any data-protection breach.
Counsel can accept much of it. The work is sorting the clauses into three piles: what the GDPR requires, what the company can offer within its operations, and what it must push back on. Each answer has to satisfy the customer’s privacy team and match what the platform actually does.
What the research has to settle
The rules behind the answer
- The GDPR sets the minimum content
- A processor contract must set out the subject matter, duration, nature and purpose of processing, the types of data and categories of data subjects, and the processor’s duties: documented instructions, confidentiality, security, help with data subject rights and deletion or return at the end.
- Sub-processors: specific or general authorisation
- The processor needs the controller’s prior specific or general written authorisation to use sub-processors. Under a general authorisation, it must tell the controller of intended changes and give it the chance to object.
- Breach notice: without undue delay
- The GDPR requires the processor to notify the controller of a personal data breach without undue delay. The controller’s own 72-hour deadline to the authority is why customers ask for a fixed shorter period.
- Transfers outside the EEA need a basis
- Where hosting or support involves a country outside the EEA, the transfer needs a basis, such as an adequacy decision or the Commission’s standard contractual clauses. The DPA should name it.
How it runs in azta
From the question to the document
The question, as you would type it
Attached is a customer’s DPA for our HR software. It asks for 24-hour breach notice, prior approval of each sub-processor, unlimited on-site audits and uncapped data-protection liability. Which of these does the GDPR require, which are commercial asks, and what is a defensible counter-proposal for each?
You start with
A customer’s data processing agreement, uploaded
- 01
Upload the DPA
Add the customer’s DPA and your sub-processor list. azta reads them and points to the clause behind each finding.
File upload· Pro - 02
Research each clause
Ask which clauses the GDPR requires and which are commercial asks. azta cites the GDPR, the Court of Justice and the EDPB’s guidelines on controllers and processors.
Cited research· Free - 03
Draft the response
Ask for a response by clause: accept, amend or reject, with the reason and proposed wording. Edit it in Canvas.
Canvas · Ask azta· Pro You send
A clause-by-clause response with proposed changes
What you get
A clause-by-clause response with proposed changes
DPA response · draft
Response to the data processing agreement
Breach notification, clause 8. The GDPR requires notification without undue delay. We propose to notify within 48 hours of becoming aware of a breach affecting your data, with the information then available, and to add to it as the investigation continues.
Sub-processors, clause 10. We work under a general written authorisation with a published list of sub-processors. We will give you 30 days’ notice of any addition or replacement, during which you may object on reasonable data-protection grounds.
Audits and liability, clauses 12 and 15. We offer an annual audit right, met first by our independent audit reports, with on-site audits where those are not enough. Liability under this DPA follows the main agreement, with a separate higher cap for data-protection claims.
Outcomes on your numbers
What azta is worth on this task
Pro pays for itself after
14 minutes a month
At €120 an hour, that is all the time Pro (€27 a month) has to take off your desk to cover its price.
Example figures. Replace them with your own.
- Hours back a year
- 43
- Capacity at your rate
- €5,184
- More DPA responses a quarter
- 3.1
- Return on Pro
- 16×
- Research
- Drafting
- Your review
A scenario you set, not a promise. The hours that come back go to another client, or deeper into this one.
Want these numbers on your team’s real workload?
Book a demoWhat stays with you
- What the platform and the sub-processors can actually deliver.
- The commercial position on liability.
- Negotiating with the customer’s privacy team.
Frequently asked questions
- Does azta hold the EDPB guidelines?
- Yes. The EDPB collection is in the source register, alongside EU law and the Court of Justice.
- Can we answer from our standard positions?
- On Enterprise, the knowledge space holds approved internal material, such as your fallback positions, cited separately from the law.
- Is the customer’s DPA used for training?
- No. Client documents are never used for training on any plan, and they stay in the EU/EEA.
