DPA review you do in conversation with the agents: every Article 28 term quoted, every redline from your playbook, every decision yours
Every supplier DPA checked on all eight Article 28 terms, redlined from your playbook.
See one case, screen by screen ↓Data Processing Agreement Review is DPA review software: it checks supplier data processing agreements against GDPR Article 28 and the company's own positions, and privacy counsel approves. Its agents assemble each term from the DPA, master agreement, security schedule and sub-processor page, trace transfers hop by hop, predict what the supplier will resist and draft redlines only from the playbook, and a checker re-reads every quote and change. Counsel works with them in one conversation and signs every package with a reason code.
How to choose AI solutions for back-office and enterprise work →
Updated
A supplier that processes personal data on the company's behalf is a processor, and Article 28(3) GDPR lists eight terms its contract must carry. Most DPAs arrive on the supplier's own paper, with those terms spread across a DPA, a master agreement, a security schedule and a sub-processor web page. Privacy counsel reads a 50-page package against an Article 28 checklist and a Word playbook, works out which document prevails, checks where the data goes and drafts tracked changes from memory or an old deal. Procurement holds the purchase order until counsel decides.
The risk sits in what a manual review misses. No term on telling you when an instruction infringes the law. Sub-processors added “by updating its Sub-processor page”. Breach notice “within thirty (30) days” when the controller must tell the regulator within 72 hours where feasible. Support access from a country with no transfer mechanism and no transfer impact assessment. Different counsel concede different things, nobody remembers what the same supplier accepted last year, and after signature a sub-processor change notice lands in a shared inbox and its objection window passes unread.
Estimated split for one supplier DPA at a large company, from complete intake to counsel's decision, by hand and with the solution.
Eight agents read, compare, trace transfers and draft from the playbook; privacy counsel approves every redline.
Cloudhaven Analytics, a workforce-analytics supplier in London, sends its paper for 38,400 employee and contractor records in 14 countries: a three-year order worth €412,000, with go-live wanted on Mon 2 Nov. Privacy counsel Tomás Ibarra works through it with the review team in one conversation. Here is what happens, screen by screen, in the working solution.
Overnight the agents read 3 supplier packages and 9 sub-processor notices. Today shows 14 open reviews, 4 that need Tomás in the order the agents suggest, and what they found since yesterday. Beside it, the review team's conversation: the positions agent asked the DPO whether absence reason codes are special category data, and Ingrid Halvorsen answered at 08:15.
Ingrid Halvorsen: “Yes, treat it as health data. List it in Annex 1 and set the DPIA flag.”
The Article 28 scorecard lists 15 checks with the clause quoted and a chip for the document it came from: Cloudhaven DPA v3.2 (14 pages), the Master Subscription Agreement (31 pages), Security Schedule v2.4 (9 pages) and the sub-processor page captured on 12 Oct. Confidentiality is in MSA §11.2 and security in the separate schedule; DPA §1.3 decides which prevails. Result: 6 found, 2 within fallback, 5 weaker, 2 missing.
“Checker agrees · 15 of 15 quotes verified”
Tomás can replay the overnight run. The intake agent paired 4 documents with order CH-OF-2291 and found the role: processor. The clause agent found 13 of 15 terms across 54 pages. The transfer agent checked 7 hops, the counterparty agent read the 2024 negotiation, the redline agent drafted 7 changes, and the checker re-read everything on its own.
Last step: “Waiting for you · Tomás Ibarra”, with 4 counsel-tier changes and the package for him to approve.
DPA §10.1 reads “within thirty (30) days of confirming such breach.” The drawer shows the reasoning, the three positions from P-10 — preferred within 48 hours, fallback within 72 hours, walk-away more than 72 hours or “after confirming” — and where the supplier sits. It also shows what Cloudhaven did before: likely to resist (80%), having held breach notice at 72 hours in 2024.
“We must tell the regulator within 72 hours (Art. 33(1)). Thirty days after ‘confirming’ makes that impossible.”
The transfer agent follows the data from K&V Services GmbH to Cloudhaven in London (UK adequacy) and on to 6 sub-processors, checking adequacy, the Data Privacy Framework list, SCC modules and transfer assessments. Sarvik Support Services in Pune, India gives tier-2 support with access to tickets and, on request, the customer environment — on “appropriate safeguards” only, with no Module 3 and no TIA. Counsel chooses the remedy.
Recommended remedy: “Ask for SCC Module 3 and a transfer assessment within 30 days” — the P-14 preferred position.
The redline package holds 7 tracked changes — P-02, P-04, P-07, P-10, P-12, P-14 and P-15 — 4 of them counsel-tier. Each carries its position and version, the counterparty prediction and the checker's word: verbatim. The cover note to Cloudhaven's legal team is drafted and editable, asking for a reply by Monday 19 October so the service can start on 2 November.
The redline agent never writes free-text legal language, and never sends.
Tomás asks in the conversation beside the scorecard. The positions agent answers with numbered citations: the controller must tell the regulator within 72 hours, so if Cloudhaven also takes 72 the time is gone before he hears. P-10 opens at 48. Cloudhaven held 72 in 2024, so 72 is ready as the approved fallback for round 2 without going back to the DPO.
Each number in an answer opens the passage it rests on, with the quote highlighted — here GDPR Article 33(1), read by the clause agent and verified by the checker. The same works for any clause of the supplier's DPA, master agreement or schedule.
Approving the package opens the 7 changes with their tiers, a reason code — RC-01 “Matches our preferred positions” through RC-06 “Rejected: outside walk-away” — an optional note for the audit trail, and a confirmation he must tick. He picks RC-01: 48 hours stays the opening position, 72 the fallback ready.
“I have read the 4 counsel-tier changes and their sources”
The redline goes to Cloudhaven's legal contact with the cover note at 09:42, signed RC-01. The counterparty agent watches the inbox for the reply, expected by Mon 19 Oct. Marcus Adeyemi, the procurement contract manager, sees “Redline sent, reply expected Mon 19 Oct”, and the purchase request stays on hold until the DPA is agreed.
“Signed by Tomás Ibarra · redline sent to Cloudhaven”
The same DPA, seen by the five people who carry it — what their week looked like, and what it looks like now.
Eight agents read, compare, trace transfers and draft from the playbook; privacy counsel approves every redline.
Takes the supplier's package from the privacy inbox, the procurement suite or an upload, pairs the DPA, master agreement, schedules and sub-processor page with the purchase request, finds the roles and drafts the intake questions for the business owner.
Finds each Article 28 term in every document of the package, applies the order-of-precedence clause and quotes the clause with page and paragraph.
Compares each term with the company's positions — preferred, fallback and walk-away — sets the tier, and asks the DPO when data may be special category.
Follows the data hop by hop and checks adequacy, the Data Privacy Framework list, the SCC module, the UK Addendum and the transfer impact assessment.
Reads past negotiations with the same supplier and predicts which positions it will resist, with odds and the evidence, so the fallback is ready before the redline goes.
Drafts the tracked changes and the cover note, only from approved position text of the current version.
Re-reads every quote against its source and every change against the playbook text; the package cannot reach counsel until it agrees.
Reads change notices and the supplier's sub-processor page, compares them with the signed DPA and the transfer chain, starts the objection clock and recommends objecting or accepting, with the objection drafted for the vendor manager.
Approves; the DPO decides deviations. The agents propose; a named person decides.
Ask the review team about any check, or tell them what to change. Every answer carries numbered citations that open the source passage.
Why 48 hours, not 72?
You must tell the regulator within 72 hours of becoming aware. If Cloudhaven also takes 72, your time has gone before you hear. P-10 opens at 48 hours. Cloudhaven held 72 in 2024, so 72 is ready as the approved fallback; you can use it in round 2 without going back to the DPO.
Where is confidentiality?
Not in the DPA. It is in the master agreement, §11.2. The DPA prevails only where the two conflict, so the MSA clause applies, and I marked it found.
What is blocking the PO?
Only this decision. Purchase request PR-77104 is on hold for privacy review, with go-live on Mon 2 Nov. If you approve today and Cloudhaven replies by Mon 19 Oct, the date holds.
Use the 72-hour fallback
Done in the draft: the breach change now opens at 72 hours, the P-10 fallback. The checker re-read it: verbatim. You still approve the package.
13 screens from the working solution, on its sample data. Pick one to see it large.
The positions the agents draft from, who signs what and every clock are settings, and every change to them is on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Review time, from complete intake | 3 business days | Any number of business days |
| Counsel decision on a checked package | 1 business day | Any number of business days |
| Chase a supplier reply after | 5 business days | Any number of business days |
| Default sub-processor objection window | 30 days | Any number of days; alerts at 10 and 3 days left |
| Quote confidence below which a person confirms | 0.85 | Any threshold |
| Counsel-tier positions | P-07, P-10, P-13, P-14, P-15 | Any of the 15 positions |
| Special category data and transfers with no mechanism | Always go to the DPO | On · off |
| A new positions version re-checks open reviews | On | On · off |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (GDPR Art. 33(1) on the 72-hour notification to the supervisory authority; GDPR Art. 83(4) on fines of up to €10 million or 2% of worldwide annual turnover). Context: GDPR Art. 28; EDPB Guidelines 07/2020 and Opinion 22/2024; Commission Implementing Decision (EU) 2021/914 on standard contractual clauses. People, companies, suppliers and documents named on this page are fictional — characters and sample data in the working solution.
Data Processing Agreement Review is DPA review software: it checks supplier data processing agreements against GDPR Article 28 and the company's own positions, and privacy counsel approves. Its agents assemble each term from the DPA, master agreement, security schedule and sub-processor page, trace transfers hop by hop, predict what the supplier will resist and draft redlines only from the playbook, and a checker re-reads every quote and change. Counsel works with them in one conversation and signs every package with a reason code.
The clause agent builds a 15-check scorecard: the Article 28(3) terms, sub-processors and transfers, and the company's own positions such as data protection liability. Each check is marked found, within fallback, weaker or missing, with the clause quoted from whichever document it sits in and the order-of-precedence clause applied.
Yes. The transfer agent follows the data from the contracting entity to the supplier and to each sub-processor, and checks adequacy, the Data Privacy Framework list, the SCC module, the UK Addendum and the transfer impact assessment. It marks the hop with no mechanism and offers the remedies from the positions; counsel decides.
No. The redline agent drafts only from approved position text of the current version, and the checker agent re-reads every change against the playbook and every quote against its source. If the checker disagrees, the package cannot reach counsel.
The sub-processor watch agent reads each change notice and the supplier's sub-processor page, compares them with the signed DPA and the transfer chain, starts the objection clock, recommends objecting or accepting and drafts the objection. The vendor manager decides, and silence is never treated as consent.
Yes. The agents never send to a supplier, sign, accept beyond fallback or say a transfer is lawful. Privacy counsel approves every package with a reason code, contract managers act only inside the delegation, the DPO decides deviations, special category data and transfers without a mechanism, and every action is on the audit trail.
Yes. Your positions are imported with their preferred, fallback and walk-away language and versioned, and a new version re-checks open reviews. Counsel-tier positions, the delegation, review and objection clocks and the quote-confidence threshold are settings.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your DPA playbook, your template and a sample of past supplier packages — and it goes live once every quality gate has passed. We will walk you through it on your own DPAs first.
Every request answered inside its legal clock, with no other person's data released.
1-min demoEU AI Act ComplianceEvery high-risk AI system documented, cited and signed before 2 December 2027.
1-min demoPrivacy Impact AssessmentEvery new project assessed before launch, with each answer traced to its source.
1-min demoWe'll run Data Processing Agreement Review on a sample of your own past supplier packages and your playbook.