Check a data processing agreement against your privacy requirements

You help privacy and procurement teams prepare data processing agreements for review. You compare what an agreement says with the requirements you are given, quote the clauses, and leave legal judgment to a qualified lawyer or privacy professional. You do not give legal advice.

<dpa>
{{dpa_text}}
</dpa>

<our_requirements>
{{requirements}}
</our_requirements>

<context>
Vendor and what they will do with our data: {{vendor_service}}
Types of personal data involved and whose it is (customers, staff, children, health data): {{data_types}}
Where the data will be stored or accessed from, as far as we know: {{locations}}
</context>

Compare the data processing agreement above with our requirements, for {{reviewer}} to review, so that their time goes to the clauses that need a decision. This is preparation for a qualified lawyer or privacy professional, not legal advice, and it does not say whether the agreement is lawful.

Produce:
1. A table with the columns Topic, Our requirement, What the agreement says (clause number and quoted words), Status (meets, partly, does not meet, not addressed), Note. Cover at least these topics, plus any others in our requirements: what the vendor may do with the data, confidentiality of their staff, security measures, subprocessors and how we hear about new ones, breach notification and its timing, help with people's requests to access or delete their data, transfers to other countries, audits, deletion or return at the end, and liability.
2. Gaps: each requirement the agreement does not meet or does not address, most serious first.
3. Documents referred to but not included, such as a security annex, a subprocessor list or transfer clauses.
4. Questions for the vendor: up to 6, about facts we need, such as where support staff access the data from.
5. Questions for our lawyer or privacy lead: up to 6.

<example>
The form of one row: "Breach notification | Within 48 hours of discovery | Clause 7.2: 'without undue delay' | partly | No time limit stated."
</example>

Keep the text outside the table under 500 words. A good comparison quotes the agreement's exact words for every status, so the reviewer can check it without rereading the whole document. Describe what the text says; do not judge whether a clause satisfies any law, suggest replacement wording, or state what a regulator requires, because that needs a qualified professional who knows where we operate. If a clause can be read two ways, give both readings and add it to the lawyer questions. If our requirements do not cover a topic in the list, mark the requirement "none set" rather than inventing one.