PrivacyBuilt / Knowledge
Read the clause. Test the control.
A vendor DPA guide connecting contract language to the evidence behind it.
PrivacyBuilt Editorial · Reference edition 3 November 2026
Start with actual roles, not contract labels. GDPR Article 28 requirements below apply to relevant controller–processor arrangements; other laws use different roles and contract duties. This commentary is not model contract language or legal advice.
Article 28(3)(a)
Roles and documented instructions
Define purposes, duration, processing nature, data types and individuals; keep instructions traceable.
What to challenge
Watch for vague permission to reuse customer data for unrelated product development.
Evidence question
Ask which party chooses each purpose and how changed instructions are approved.
Articles 28(3)(b)–(c) and 32
Confidentiality and security
Bind authorised people to confidentiality and attach specific, risk-appropriate technical and organisational measures.
What to challenge
A statement of “industry-standard security” does not identify operating controls or assurance.
Evidence question
Request evidence of access management, encryption, testing and control ownership.
Articles 28(2) and 28(4)
Subprocessor changes
Specify prior specific or general written authorisation, change information and an opportunity to object; flow down relevant obligations.
What to challenge
Notice without a meaningful objection process or unlisted onward processing creates blind spots.
Evidence question
Check how an objection is resolved and who remains responsible for the subprocessor.
Article 28(3)(e)
Individual-rights assistance
Define how the processor assists the controller with rights requests taking account of the processing.
What to challenge
Support limited to a standard export can miss derived data or other rights.
Evidence question
Agree request channels, responsibilities and response support that fits applicable clocks.
Articles 28(3)(f) and 33(2)
Breach escalation and compliance assistance
Require processor-to-controller breach notice without undue delay and assistance with Articles 32–36.
What to challenge
Do not let a contractual fixed window excuse delaying notice, or require confirmed harm before escalation.
Evidence question
Specify initial facts, update cadence, contacts, evidence preservation and DPIA assistance.
Article 28(3)(h)
Audit and assurance
Require information demonstrating compliance and allow and contribute to audits, including inspections, by the controller or mandated auditor.
What to challenge
Certifications alone are not an automatic substitute for Article 28 audit rights.
Evidence question
Agree proportionate access, confidentiality and a route for serious incident investigations.
Article 28(3)(g)
Return, deletion and exit
At the controller’s choice, delete or return data after service and delete copies unless law requires storage.
What to challenge
Check backups, exports, termination access and claims of indefinite residual copies.
Evidence question
Define deliverable formats, disposal evidence and the treatment of legal holds.
Chapter V; SCCs where applicable
Transfers and government requests
Map destinations and onward recipients, choose valid transfer routes and address relevant access risks.
What to challenge
SCC signatures and hosting-region labels do not by themselves establish effective protection.
Evidence question
Verify SCC modules, annexes, TIA evidence, key control and change triggers.
Commercial drafting; GDPR Article 82 remains relevant
Liability and commercial allocation
Negotiate liability, indemnity, insurance and fees with legal and commercial teams, separately from statutory duties.
What to challenge
There is no universal GDPR-mandated liability cap; a cap does not remove statutory rights or responsibilities.
Evidence question
Review how caps interact with incident costs, audit support and rights-assistance charges.