# Review a data processing agreement against GDPR Article 28

Checks a vendor DPA for the mandatory processor terms, transfer safeguards, and security commitments, and suggests redlines for gaps.

- Topic: Legal & Compliance
- Framework: Few-Shot
- Level: Standard
- Tags: Legal, Writing, Analyze, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/review-a-data-processing-agreement-against-gdpr-article-28

## Prompt

```text
Review this data processing agreement (DPA) against GDPR Article 28 and common good practice.

**DPA text:** [PASTE]
**Main agreement context:** [service provided, vendor name, our role: controller / processor]
**Personal data and data subjects involved:** [e.g. "customer names, emails, payment data"]
**Special category or high-risk data?** [yes/no - details]
**Where the vendor and its sub-processors process data:** [COUNTRIES]
**Other laws in scope:** [e.g. UK GDPR, CCPA/CPRA, other local laws]

Check for each Article 28(3) element and mark Present / Weak / Missing, with the section number:
- Processing only on documented instructions, including for transfers
- Confidentiality of personnel
- Security measures (Article 32) - are the technical and organizational measures specific or vague?
- Sub-processor conditions: prior authorization, notice of changes, right to object, flow-down, liability for sub-processors
- Assistance with data subject rights
- Assistance with security, breach notification (timing in hours), DPIAs, and prior consultation
- Deletion or return at end of services
- Information and audit rights
- Duty to tell us if an instruction infringes data protection law

Also check: description of processing (subject matter, duration, nature, purpose, data types, data subjects); international transfer mechanism (e.g. SCCs, adequacy) and transfer risk assessment; liability caps that undercut the DPA; conflicts with the main agreement.

Return: the checklist table, then suggested redline language for each gap, then a short summary for the business owner. This is a review aid; a qualified privacy lawyer must confirm before signing.
```

## What to fill in

- PASTE
- e.g. "customer names, emails, payment data"
- yes/no - details
- COUNTRIES
- e.g. UK GDPR, CCPA/CPRA, other local laws

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.