Is this DPA checklist a substitute for a lawyer's review?

No. It's the same clause list our lawyers check on every DPA review, in checkbox form, so you can spot obvious gaps yourself first. It doesn't tell you whether a specific clause is enforceable under your governing law, or how to negotiate it — that's what the paid review adds.

Does checking every box mean my contract is safe to sign?

It means the clause is present and worth a closer look — not that its wording is fair or enforceable. A clause can exist and still favour the other side. For that judgment, send it for a lawyer's review.

DPA Checklist | ContractDesk

The DPA clause checklist

What a DPA must contain — and how enforceable its terms are — depends on the data-protection regime that applies to the processing, which is often not the same as the governing law of the underlying commercial contract. We review each clause against the law and regulatory regime that applies to your agreement, whether that is a single jurisdiction or a cross-border data flow.

Check these first — high risk

Scope & Purpose of ProcessingHigh risk

What data may be processed, for what purpose, and whether the processor can use it for anything beyond providing the service.

Sub-processor TermsHigh risk

Whether the vendor can appoint sub-processors, whether you are notified, and whether the same data-protection obligations flow down to them.

Security MeasuresHigh risk

The technical and organisational safeguards the processor commits to — vague "reasonable security" language is common and hard to enforce.

Breach NotificationHigh risk

How quickly the processor must notify you of a data breach, and what information that notice must include.

Cross-Border Transfer MechanismHigh risk

The legal basis for moving data across borders — standard contractual clauses or an equivalent mechanism — where processing spans jurisdictions.

Review closely

Data Subject Rights AssistanceReview close

Whether the processor is obligated to help you respond to access, correction, or deletion requests from individuals.

Audit & Inspection RightsReview close

Whether you can actually verify compliance — audit rights, certifications accepted in lieu, and how often they can be exercised.

Data Return & Deletion on TerminationReview close

What happens to your data when the underlying contract ends — return, certified deletion, or an ambiguous silence.

Liability & Indemnity for Processing FailuresReview close

Whether general contract liability caps apply to data-breach losses, or whether the DPA carves out its own (often higher) exposure.

Standard clauses

Records of ProcessingStandard

Documentation obligations that support your own compliance and accountability requirements.

DPA Review Checklist

Before you start

The DPA clause checklist

Check these first — high risk

Review closely

Standard clauses

Frequently asked questions

Want a lawyer to check it properly?

Related checklists