Data Processing Agreement Review: 12 Clauses to Understand Before You Sign

A data processing agreement is the contract that governs what a vendor may do with the personal data a business hands it: customer records in a CRM, employee files in a payroll tool, chat transcripts in a support platform, documents in an AI service. For founders and small business owners it tends to appear at the end of a software purchase or a sales cycle, as a "standard" addendum that procurement, a customer or an investor's diligence checklist suddenly asks about, usually with a deadline attached.

This guide explains what a data processing agreement (DPA) is, who it binds, and the 12 clauses that most often deserve a second read, from processing instructions and sub-processors to breach notice, audits, international transfers, liability and deletion. It is general legal information for people who want to understand the terms before they sign, whether they are the customer reading a vendor's DPA or the vendor whose customer sent one over. It is not legal advice. It is not a substitute for the advice of an attorney; for advice on any contract, routine or not, talk to a lawyer.

If a draft is already on your desk, the data processing agreement review page explains how Justee's AI-assisted review handles this document type, and the DPA review overview covers the same workflow for privacy and procurement teams. The primary source for most DPA language is the text of the General Data Protection Regulation (GDPR), published on EUR-Lex.

What a data processing agreement is, and when one is needed

Privacy laws divide the businesses that handle personal data into two roles. The controller decides why and how personal data is processed. The processor handles that data on the controller's behalf and under its instructions. A company using an email marketing platform is usually the controller of its subscriber list; the platform is usually the processor. The European Data Protection Board's Guidelines 07/2020 on the concepts of controller and processor explain how regulators draw that line, and they stress that the label in the contract does not decide the role. The facts of who decides the purposes and means of the processing do.

Under Article 28 of the GDPR, processing by a processor is governed by a contract, or another legal act, that binds the processor to the controller. Article 28(3) lists what that contract covers: the subject matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects, and the obligations and rights of the controller. It then lists the processor's core duties, which become most of the 12 clauses below. The European Commission has also adopted standard contractual clauses for controller-processor contracts (Implementing Decision (EU) 2021/915), which parties may use as the Article 28 contract or as part of it.

The United States has no single federal equivalent, but state privacy laws have converged on similar contract terms. California's Consumer Privacy Act requires a business that discloses personal information to a service provider or contractor to do so under a written contract with specific terms (Cal. Civ. Code § 1798.100(d)), and the California Privacy Protection Agency's CCPA regulations spell out what those contracts contain. The California Attorney General's CCPA overview is a plain-language starting point. Virginia's Consumer Data Protection Act sets out processor contract requirements in Va. Code § 59.1-579, and several other state privacy laws follow the same pattern. Which laws apply to a given business depends on thresholds, locations and the data involved, and that is a question for a lawyer.

In practice, a DPA is rarely a standalone deal. It is usually an addendum to a SaaS agreement, a service agreement or a platform's terms of service, and it often has annexes that describe the processing, the security measures and the list of sub-processors. Reading the DPA without the main agreement misses half the picture, because the main agreement usually holds the liability cap, the term and the termination rights that the DPA relies on.

A DPA is also different from other privacy-related contracts. A controller-to-controller data sharing agreement covers two businesses that each decide their own purposes for the data. A confidentiality agreement covers business secrets rather than personal data; Justee's confidentiality agreement review page covers that document type. Contracts for health data under federal health-privacy rules follow their own required terms. Knowing which contract is on the table is the first step in reading it well.

Clauses 1 to 4: roles, instructions, confidentiality and use limits

The first group of clauses defines who is doing what with the data, and how far the vendor's permission reaches. Most disagreements later in the relationship trace back to these definitions.

1. Roles and the description of processing

Most DPAs open by naming each party's role and pointing to an annex that describes the processing: what personal data, about whom, for what purpose and for how long. The annex sounds administrative, but it sets the boundary for everything else. A vague description, such as "customer data as necessary to provide the services," gives the vendor wide room. A specific one, such as "contact details and order history of end customers, processed to send transactional email," draws a clearer line. Under U.S. state laws, the same section usually confirms that the vendor acts as a "service provider," "contractor" or "processor" and lists the business purposes for which it may use the data.

2. Documented instructions

Article 28(3)(a) of the GDPR says the processor processes personal data only on the controller's documented instructions, and the final paragraph of Article 28(3) requires the processor to tell the controller immediately if, in its opinion, an instruction infringes data protection law. Many DPAs define the documented instructions as the main agreement, the product configuration and the customer's use of the service. The practical questions are what happens when the customer wants something different, whether additional instructions cost extra, and whether the vendor may decline instructions it considers unworkable.

3. Confidentiality of personnel

The processor commits that the people authorized to process the personal data are bound by confidentiality, either by contract or by law (Article 28(3)(b)). DPAs often add access controls, background checks or training commitments here. This clause is rarely negotiated, but it is worth checking that it reaches contractors and affiliates, not only employees.

4. Use limits, including analytics and AI training

This is where U.S. state law adds the most detail. The CCPA regulations describe service provider contracts that prohibit selling or sharing the personal information, retaining or using it outside the direct business relationship or the specified business purposes, and combining it with personal information from other sources except as the regulations allow. Many vendor DPAs then carve out the vendor's own uses: aggregated or de-identified data, product improvement, security monitoring and, increasingly, the training of machine-learning models. Those carve-outs are often the most consequential lines in the document for a business whose own customers trust it with sensitive data. Common requests include a narrower definition of de-identified data, a clear statement on whether customer content is used to train models, and an opt-out where one exists.

Justee is designed to help readers notice clauses like these, such as broad product-improvement or model-training rights, so they can bring sharper questions to a lawyer.

Clauses 5 to 8: security, sub-processors, breach notice and assistance

The second group covers how the data is kept safe, who else touches it, and what the vendor does when something goes wrong.

5. Security measures

Article 28(3)(c) ties the processor to the security obligations in Article 32 of the GDPR, which calls for appropriate technical and organisational measures that take into account the state of the art, the costs and the risks to individuals, and which mentions measures such as pseudonymisation and encryption. Most DPAs put the specifics in a security annex: encryption, access control, logging, backups, testing and incident response. Two points are worth reading closely. The first is whether the annex is a fixed commitment or a description the vendor may update, and if updates are allowed, whether they can reduce the level of protection. The second is whether the annex refers to an external framework. The NIST Privacy Framework and the FTC's privacy and security guidance for businesses are useful references for what reasonable measures can look like in the United States.

6. Sub-processors

Vendors rely on other vendors: cloud hosting, email delivery, support tools and AI model providers. Under Articles 28(2) and 28(4), a processor may engage another processor only with the controller's prior specific or general written authorization, has to flow down the same data protection obligations by contract, and remains fully liable to the controller for the sub-processor's performance. Most SaaS DPAs use general authorization with a published sub-processor list and a notice mechanism for changes. The details vary widely: how much notice comes before a new sub-processor starts, how the notice is delivered (email, a web page or a subscription feed), whether the customer may object, and what happens after an objection. Often the only remedy offered is termination of the affected service, sometimes with a refund of prepaid fees.

7. Personal data breach notification

Article 33(2) of the GDPR requires a processor to notify the controller without undue delay after becoming aware of a personal data breach. The controller, in turn, generally notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as Article 33(1) of the GDPR provides. Because the controller's clock is short, many customers look for a specific contractual window for the vendor's notice, a list of what the notice will contain, and a commitment to provide updates and cooperation. U.S. state breach-notification laws add their own timelines and content rules, which is one reason this clause is so often negotiated.

Illustrative example; have a lawyer adapt any clause to your contract and state. "Processor shall notify Controller without undue delay, and in any event within [X] hours, after becoming aware of a Personal Data Breach affecting Controller Personal Data, and shall provide the information reasonably available to it about the nature of the breach, the categories of individuals and records concerned, and the measures taken or proposed."

8. Assistance with rights requests and assessments

Processors commit to help the controller respond to people exercising their rights, such as access, deletion and correction requests (Article 28(3)(e)), and to help with security, breach notification, data protection impact assessments and prior consultation with regulators (Article 28(3)(f), which refers to Articles 32 to 36). U.S. state laws contain similar assistance duties. The negotiable parts are usually practical: whether assistance is self-service through product features, whether it is free or billed at the vendor's rates, and how quickly the vendor responds to a request.

Clauses 9 to 12: audits, transfers, liability and exit

The last group decides how compliance is shown, where the data may travel, who pays when things go wrong, and what happens to the data at the end.

9. Audits and information

Article 28(3)(h) requires the processor to make available the information needed to demonstrate compliance and to allow for and contribute to audits, including inspections, by the controller or an auditor it mandates. Vendor DPAs commonly meet this first with documents: third-party audit reports, certifications, security questionnaires and written policies. On-site audits are then limited in frequency, require advance notice, are subject to confidentiality and are at the customer's cost unless a problem is found. For a small business, the paper route is usually what matters in practice; the question is whether the documents on offer cover the services actually purchased.

10. International data transfers

When personal data from the European Economic Area moves to a country without an adequacy decision, the GDPR requires a transfer mechanism. The most common one in DPAs is the European Commission's standard contractual clauses for international transfers, adopted in Implementing Decision (EU) 2021/914, which come in four modules: controller to controller, controller to processor, processor to processor and processor to controller. Reading which module the DPA incorporates, and which options it selects (governing law, the optional docking clause, and how sub-processor authorization works), shows how the transfer is meant to operate. For U.S. recipients, the EU-U.S. Data Privacy Framework, which the European Commission found adequate in July 2023, is an alternative for companies that have self-certified. It has faced legal challenges in the EU, so many DPAs keep the standard contractual clauses as a fallback. Transfers from the United Kingdom use the UK's own tools, the International Data Transfer Agreement or the UK Addendum to the EU clauses, described in the ICO's international transfers guidance.

11. Liability, indemnity and the cap

Many DPAs say nothing about liability and simply defer to the main agreement, which means the main agreement's limitation of liability clause caps data protection claims too. Others set a separate, higher cap (often called a super-cap) for data protection breaches, or carve certain losses out of the cap entirely. The GDPR has its own liability rule as well: under Article 82, a processor is liable for damage caused by processing only where it has not complied with obligations specifically directed to processors or has acted outside or contrary to the controller's lawful instructions. Regulatory exposure explains why customers read this clause closely. Under Article 83(4) of the GDPR, infringements of the controller and processor obligations, including Article 28, can draw administrative fines of up to 10 million euros or 2% of total worldwide annual turnover, whichever is higher. How the cap, the indemnity and the statute interact for a specific deal is a question for a lawyer.

12. Deletion, return and order of precedence

At the end of the services, Article 28(3)(g) requires the processor, at the controller's choice, to delete or return the personal data and delete existing copies, unless the law requires storage. DPAs differ on the time allowed, whether backups are covered and on what schedule they roll off, whether a deletion certificate is available, and whether "return" means a usable export format. The final clause worth reading is the order of precedence: when the DPA, the main agreement, the standard contractual clauses and a privacy policy conflict, which one wins. Many DPAs say the standard contractual clauses prevail over the DPA, and the DPA prevails over the main agreement on data protection matters. Justee's service agreement review guide explains how precedence clauses work in master agreements generally, and the automatic renewal clause guide covers the term mechanics that decide when the exit actually happens.

Reading a data processing agreement yourself vs AI-assisted review

Both approaches start the same way: read the DPA alongside the main agreement and every annex. The difference is how quickly a reader gets to the questions worth asking. Reading it yourself builds the deepest understanding, but DPAs are dense and cross-reference statutes, annexes and web pages. AI-assisted review lists the terms worth understanding so the reader can spend time on them. Neither one is legal advice, and neither replaces a conversation with a lawyer about a specific contract.

According to Justee, its review accepts a PDF or DOCX file, including scanned PDFs, or pasted text, and lists findings rated Critical, Moderate or Note. According to Justee, reviews typically take 1 to 6 minutes. The reader selects the U.S. state whose law the review should consider; the free trial allows one jurisdiction per document and paid plans allow up to two. The review draws on a reference library of over 1 million sections of U.S. and England & Wales legislation. Using Justee on a data processing agreement is a way to see the clauses above flagged in context before deciding which questions to take to counsel.

How to review a data processing agreement with Justee

Justee is designed to help a reader understand a data processing agreement before signing it, not to decide whether to sign it. A five-step sequence works for most DPAs, whichever side of the deal the reader is on.

1. Gather the set. The DPA, its annexes, the main agreement, the current sub-processor list and any security page the DPA links to. Clauses that point to a web page incorporate whatever that page says, so it helps to save a copy of the version in force on the signing date.
2. Reduce personal data in the file where it makes sense. A DPA rarely contains much personal data, but signed copies and negotiation emails include names, titles and contact details. The Justee PII Redaction Tool detects names, organizations, addresses, contact details, dates of birth, and government and financial ID numbers on a best-effort basis, and shows how many items of each type it replaced. It accepts PDF and DOCX files. Redaction reduces how much personal data reaches the AI model; it does not make a workflow GDPR or CCPA compliant. The guide what is PII redaction explains the concept.
3. Run the review. Upload the DPA, or paste the text, select the state, and read the findings rated Critical, Moderate or Note against the 12 clauses in this guide.
4. Compare drafts. When a vendor returns a marked-up version, Justee Document Comparison accepts PDF, DOCX and TXT files and lists changes by type. Changes to the processing annex or the sub-processor clause are easy to miss in a long redline.
5. Take the questions to a lawyer. Justee Legal AI Chat gives general legal information about concepts such as sub-processor authorization or transfer modules; it does not draft letters or filings for the user's matter. For advice on any contract, routine or not, talk to a lawyer.

According to Justee, its document comparison is rule-based: it lists insertions, deletions, replacements and visual changes, and it does not explain what a change means.

Because a DPA review means uploading a contract, it is fair to ask Justee the same questions a DPA asks of any vendor. According to Justee, documents are processed on Justee's servers, which are hosted on AWS. Files are encrypted in transit (TLS 1.2+) and at rest (AES-256). Guest files are deleted after 24 hours, chats may be deleted after 30 days of inactivity, and reviews in an account are kept until the user deletes them. Full Private Mode is optional on all paid plans: Justee's servers process the document, then seal the result with a key only the user holds, and it covers only the items made with it on. The privacy FAQ, the Private Mode page and the article do AI tools store my uploaded documents have more detail. Plans run from $16/month to $149/month, billed annually (monthly billing costs more), and free use has page, state and usage limits described on the pricing page.

Questions people often raise with a lawyer about a DPA

A short, specific list of questions makes a conversation with a lawyer more productive. Topics that commonly come up for data processing agreements include:

• Which privacy laws apply to the business and to this vendor relationship, and whether the DPA addresses each of them.
• Whether the vendor's role is really processor or service provider for every use, or whether some uses, such as analytics or model training, make it a controller or a third party for that data.
• Whether the sub-processor notice period and objection right fit the business's own commitments to its customers.
• Whether the vendor's breach notice window leaves enough time for the business's own notifications.
• How the liability cap applies to data protection claims, and whether insurance covers any gap.
• Which transfer mechanism applies, and whether a transfer risk assessment is expected.
• How the DPA fits with the business's own privacy notice and customer contracts.

Startups that sell software often sit on both sides at once: they sign their vendors' DPAs and send their own DPA to enterprise customers. The startup contract review page covers that workflow, and the AI contract review software buying guide explains what to look for in a review tool, including how a provider handles uploaded documents.

A data processing agreement can look like boilerplate, but its annexes, use limits, sub-processor terms, breach window, liability cap and exit clause decide how personal data is handled long after the purchase. Many businesses read those clauses together with the main agreement and take the open questions to a lawyer. Justee helps readers understand a data processing agreement before they sign; it is legal information, not legal advice. It is not a substitute for the advice of an attorney; for advice on any contract, routine or not, talk to a lawyer.

Max Zaykov is the founder of Justee.ai, an AI tool that helps people understand their legal documents.

Justee is not a law firm. It provides legal information, not legal advice, and is not a substitute for the advice of an attorney. Laws and regulations change; check the current text of any law mentioned here, and talk to a lawyer about your situation.