DPA Playbook: Data Processing Agreement Positions and Fallbacks

A data processing agreement (DPA) playbook sets the position a reviewer takes on each DPA term, the acceptable fallback and the point of escalation. Start with the processor duties in Article 28(3) of the General Data Protection Regulation (GDPR), then fix the open terms: subprocessor notice, breach notice hours, audits, transfers, deletion, liability caps and artificial intelligence (AI) training.

Key takeaways

• Article 28(3) fixes the floor. A DPA missing any of its eight processor duties, or the Annex I processing description, is a gap for both parties.
• The negotiation happens in the terms the GDPR leaves open: days of subprocessor notice, hours for breach notice, the shape of an audit, and whose liability cap applies.
• As of November 13, 2026, the European Union and United States (EU-US) Data Privacy Framework is in force, but an appeal is pending and regulators have asked for a reassessment. Draft an automatic fallback to the 2021 standard contractual clauses (SCCs).
• Article 28 says nothing about model training. If the customer wants none, the DPA must say so and must prevail over the vendor's online terms.
• California's service provider terms under the California Consumer Privacy Act (CCPA) are a different list from Article 28 and need their own clause.

Last reviewed November 13, 2026. This playbook is general information for lawyers, not legal advice for a specific matter. Gavel publishes it and makes Gavel Exec.

Controller, processor or subprocessor: which side this playbook takes

Every row takes the controller's side: the customer that decides why personal data is processed and hands it to a vendor. Under the CCPA the same party is the "business" and the vendor is the "service provider"; under Virginia's Consumer Data Protection Act the labels are controller and processor. A processor reviewing a customer's paper reads the table from the right: the fallback column is usually signable, and the escalation column lists the demands its security and finance teams should see.

The third seat is processor to subprocessor. Article 28(4) requires the processor to impose "the same data protection obligations" on each subprocessor, and the processor "shall remain fully liable" for the subprocessor's failures. A processor buying hosting or an AI model service should run this playbook as a controller would, using Module Three of the 2021 clauses for restricted transfers.

Under Article 28(10), a processor that determines the purposes and means of processing "shall be considered to be a controller" for that processing. If the vendor wants the data for its own products, the parties need a controller-to-controller agreement or a narrower scope.

The DPA playbook table

Thirteen issues for the controller in a mid-sized commercial deal. Adjust the numbers to the sensitivity of the data.

Subprocessor notice and the right to object

Article 28(2) allows "prior specific or general written authorisation." Under general authorization the vendor must notify changes, "thereby giving the controller the opportunity to object." Vendor forms, including the Common Paper DPA, version 1.1, use general authorization, so the fight is over notice days and what an objection achieves.

The 2021 SCCs leave the number blank in Clause 9(a): "at least [Specify time period] in advance." Common Paper fills it with 10 business days' notice and 30 days to object. The European Data Protection Board's Opinion 22/2024 adds that, per Hunton's summary, the controller should have each subprocessor's identity "readily available at all times," so ask for the full chain.

Preferred language:

Processor will give Customer at least thirty (30) days' notice by email before any new Subprocessor processes Customer Personal Data, naming the Subprocessor, its location and its processing. Customer may object on reasonable data protection grounds within that period. If the objection is not resolved within thirty (30) days, Customer may terminate the affected Services and Processor will refund prepaid fees for the terminated period.

Fallback language:

Processor will notify subscribers to its Subprocessor list at least ten (10) business days before a new Subprocessor begins processing. Customer may object within thirty (30) days after the notice, and if Processor offers no reasonable alternative, Customer may terminate the affected Services for a pro rata refund.

Typical pushback: the vendor offers notice with no termination right. Hold the termination right, because without it the objection changes nothing.

Breach notice timing and triggers

Article 33(2) says the processor "shall notify the controller without undue delay after becoming aware of a personal data breach." Article 33(1) gives the controller, where feasible, "not later than 72 hours after having become aware" to notify the regulator. A processor clause that uses all 72 hours leaves the controller with none.

Common Paper commits to "without undue delay when feasible, but no later than 72 hours." A June 2026 article by Brian Heller of Outside GC describes customers seeking notice "within 24-48 hours of discovery." Venable cautions that a very short deadline "may be impractical and provide little marginal benefit to the customer," so 48 hours with information in phases is a workable middle.

The trigger matters too. For data covered by California law, Cal. Civ. Code 1798.82(b) requires a business holding data it does not own to notify the owner "immediately following discovery."

Preferred language:

Processor will notify Customer of any Personal Data Breach affecting Customer Personal Data within forty-eight (48) hours after Processor or any Subprocessor becomes aware of it, describing what is then known of its nature, the individuals and records concerned, likely consequences and measures taken. Processor will supplement the notice as facts develop and will not delay notice to finish its investigation.

Fallback language:

Processor will notify Customer without undue delay, and no later than seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data, providing the Article 33(3) information in phases where necessary.

Typical pushback: the vendor wants to exclude unsuccessful attempts such as port scans, which is a reasonable exclusion. Refuse any trigger based on the vendor's own conclusion that harm is likely, since that call belongs to the controller.

International transfers: 2021 SCCs, UK tools and the Data Privacy Framework

A transfer from the European Economic Area (EEA) to a country without an adequacy decision needs a Chapter V tool, usually the SCCs in Implementing Decision (EU) 2021/914. The 2010 clauses were repealed effective September 27, 2021. For the United Kingdom (UK), the Information Commissioner's Office says "The EU SCCs are not valid on their own" and offers its international data transfer agreement (IDTA) or its addendum to the EU SCCs, with updates planned in 2026.

The Data Privacy Framework rests on the Commission's adequacy decision of July 10, 2023. The European Data Protection Board's business guidance of January 15, 2026 says transfers to a certified company need no "further safeguards," but the exporter must check the Data Privacy Framework List and confirm the certification covers the data. The UK Extension has applied to UK data since October 12, 2023.

Status today: the framework is in force. The General Court dismissed Philippe Latombe's challenge on September 3, 2025 (WilmerHale), and his appeal, Case C-703/25 P, is pending. On June 29, 2026, Trump v. Slaughter held that the for-cause removal protection for Federal Trade Commission commissioners "is contrary to the separation of powers," and on July 31, 2026 the Board asked the Commission to "closely assess" the effect.

Faegre Drinker (September 2026) and Hogan Lovells Cadwalader (October 2026) both treat the framework as valid. Faegre Drinker recommends DPA provisions that fall back to SCCs automatically, which is the preferred position below.

Preferred language:

Where Processor relies on its EU-U.S. Data Privacy Framework certification or the UK Extension, it will keep that certification active for Customer Personal Data and notify Customer within five (5) business days of any lapse. If the certification lapses or the underlying adequacy decision is suspended or invalidated, the Standard Contractual Clauses in Schedule 3, with the UK Addendum for UK data, apply to the affected transfers from that date without further action.

Fallback language:

If Processor's transfer mechanism ceases to be valid, the parties will adopt an alternative lawful mechanism within thirty (30) days, and Processor will suspend affected transfers until one is in place.

Typical pushback: the vendor says certification makes SCCs unnecessary. Dormant SCCs cost little to sign, and they prevent a rushed renegotiation if the Court of Justice rules against the framework.

Liability: does the DPA sit under the main agreement's cap?

When the DPA is an addendum, the main agreement's limitation of liability often reaches it unless the DPA says otherwise. Common Paper makes that the default, stating DPA liability is "subject to the waivers, exclusions, and limitations of liability stated in the Agreement," with an optional separate cap. It leaves liability to individuals and under the transfer clauses unlimited.

Fee-based caps rarely match breach costs. BakerHostetler gives the example of a $10,000 contract whose cap "is not going to help very much with $550,000 in forensics costs," and notes data obligations are often under "super caps." Where more than one party is responsible for the damage, Article 82(4) makes each liable to the data subject for the entire damage, with recourse under Article 82(5). The cap governs only recovery between the parties.

Preferred language:

Notwithstanding the Agreement, each party's aggregate liability for breach of this DPA or its data security obligations will not exceed the greater of three (3) times the fees paid or payable in the twelve (12) months before the claim and [$2,000,000], in addition to the general cap. Nothing in this DPA limits liability to data subjects or under the Standard Contractual Clauses.

Fallback language:

The Agreement's limitations of liability apply to this DPA, except that for claims arising from a Personal Data Breach caused by Processor's breach of this DPA, the cap is two (2) times the amount stated in the Agreement. Liability to data subjects and under the Standard Contractual Clauses remains uncapped.

Typical pushback: the vendor offers a "super cap" equal to 12 months of fees, which often restates the general cap. Test any number against record volume and the vendor's cyber insurance limits.

AI model training on customer data

Article 28 predates current AI products and does not mention training. Article 28(3)(a) limits processing to documented instructions, and Article 28(10) makes a processor that sets its own purposes a controller. Training a general model on one customer's data for all customers is a purpose the customer did not set.

The CCPA is more permissive. 11 CCR 7050(a)(3) lets a service provider use data "to build or improve the quality of the services" if it does not use it to serve another person. A customer that wants no training has to write that in.

Preferred language:

Processor will not use Customer Personal Data, or prompts, files or outputs containing it, to train, fine-tune or evaluate any machine learning model other than one used solely to provide the Services to Customer. Processor will bind each AI model Subprocessor to the same restriction and to deletion of inputs and outputs after each request, subject to retention required by law.

Fallback language:

Processor may use aggregated usage metrics containing no Personal Data to operate and improve the Services. Any other use of Customer Personal Data for model training requires Customer's written opt-in, revocable on thirty (30) days' notice.

Typical pushback: the vendor says the data is de-identified before training. Ask how, who holds any re-identification key, and whether outputs can reproduce customer content, and keep the opt-in until the answers are in the DPA.

CCPA service provider terms and other US state laws

Cal. Civ. Code 1798.100(d) requires an agreement with every service provider, and 11 CCR 7051(a) lists ten terms, from no selling or sharing to help with consumer requests; 7051(b) pushes them into subcontracts. A one-line "vendor is a service provider" clause does not meet 7051(a)(2), and under 7051(c) a business that never uses its contract rights may lose the argument that it had no reason to suspect misuse.

Va. Code 59.1-579(B) adds confidentiality, deletion or return at the controller's direction, compliance information, reasonable assessments or an independent assessor's report, and written subcontracts.

How positions change by industry and company size

Only segments where the DPA itself changes are listed. Where a sector law adds its own agreement, the DPA should cross-refer to it.

Pre-signature DPA review checklist

1. Confirm the roles; a vendor using data for its own products needs more than a DPA.
2. Match Annex I to the order form, including special category data.
3. Tick off Article 28(3)(a) through (h) and the unlawful-instruction notice.
4. Read Annex II for named measures and a no-decrease promise.
5. Open the subprocessor list; confirm locations, notice days and the objection remedy.
6. Check the breach clock and that it runs from "becoming aware."
7. Match every restricted transfer to a current tool, with SCC fallback behind any framework reliance.
8. Confirm audit rights go beyond reports.
9. Set deletion days, including backups.
10. Read the main agreement's cap and decide whether the DPA sits under it.
11. Search all vendor terms for "train", "improve", "aggregate" and "de-identified".
12. Confirm the 7051(a) terms and the order of precedence.

Red flags a reviewer should never miss

• The vendor may amend the DPA by posting a new version.
• "Breach" excludes incidents at subprocessors.
• Terms of service or AI terms rank above the DPA.
• Transfer language relies on the 2010 clauses or the old Privacy Shield.
• The DPA cap is lower than the main agreement's cap.

Running this DPA playbook in Gavel Exec

Gavel Exec is AI contract review and drafting software that works inside Microsoft Word. It generates playbook rules from a checklist, a spreadsheet playbook or signed agreements (.docx, PDF or .csv), so you can paste the table above into a spreadsheet and upload it as your starting rule set. See how playbooks in Gavel Exec are built and shared.

With a vendor's DPA open in Word, Gavel Exec applies the rules as priority-ranked tracked changes with reasoning for each, and lists missing terms. In the web app, benchmarking labels each provision on-market, off-market or missing. Pricing is $160 per user per month or $1,740 per user per year, and each user gets 25 free queries with no credit card.

Frequently asked questions

What must a data processing agreement include under GDPR Article 28?

It must describe the processing (subject matter, duration, nature, purpose, data types and data subjects). It must also bind the processor to documented instructions, staff confidentiality, Article 32 security, subprocessor conditions, assistance to the controller, deletion or return, and audits.

Is a DPA required under the CCPA?

Yes. Cal. Civ. Code 1798.100(d) requires an agreement with every service provider or contractor, 1798.140 requires it in writing, and 11 CCR 7051(a) lists the terms it must contain.

How quickly must a processor report a data breach to the controller?

The GDPR says "without undue delay" and sets no hour count for processors, while the controller has 72 hours to notify the regulator. Published forms and practitioner commentary range from 24 to 72 hours from when the processor becomes aware.

Is the EU-US Data Privacy Framework still valid?

Yes. As of November 13, 2026, the adequacy decision of July 10, 2023 remains in force, though an appeal is pending in Case C-703/25 P and the European Data Protection Board has asked the Commission to assess whether Trump v. Slaughter affects it, so DPAs should include a fallback to the SCCs.

Should the DPA be subject to the main agreement's liability cap?

It often is by default, unless the DPA says otherwise. Data protection obligations are often given a separate, higher super cap, and liability to data subjects is unaffected by either cap.

Can a vendor use customer data to train AI models under a DPA?

Under the GDPR, a processor that trains models for its own purposes risks being treated as a controller for that processing, and the CCPA regulations allow internal service improvement unless the contract restricts it. If the customer wants no training, the DPA must say so and prevail over the vendor's online terms.

Related reading: How Dorna Moini uses AI to review data protection agreements, what a contract playbook is and how to build one, and commercial contract review software.