Document Automation
Product features
By practice area
By company size
Contract Review
PRODUCT FEATURES
Resources
LearN
Case Studies
Pricing
How to review a data processing agreement with AI: the terms GDPR Article 28 and the CCPA require, the clauses that need negotiation, breach notice timing, and which review steps to hand to AI.
Easy intake and document automation to auto-populate your templates.
It is 4:45 on a Thursday, and procurement has forwarded a vendor's data processing agreement with a one-line note: "Standard DPA, can you sign today?" Anyone who has worked in-house knows the DPA is rarely standard. It is the document that decides who can touch your customers' personal data, which countries that data travels to, and how long you wait to hear about a breach.
The good news is that DPAs are among the most structured contracts a legal team reviews. The law sets a floor, your team sets positions above it, and most of the negotiation happens on the same eight or nine clauses every time.
The short answer: The best AI tool for reviewing data processing agreements (DPAs) checks the draft against the terms the law requires, applies your own positions on sub-processors, breach notice, and audits, and returns redlines in the Word document you are negotiating. Gavel Exec does this as a Microsoft Word add-in: it runs a DPA playbook against the draft, marks each rule as passed or failed with a link to the clause, and proposes tracked-change redlines for every failure.
Article 28(3) of the General Data Protection Regulation (GDPR) requires a binding contract that describes the subject matter, duration, nature, and purpose of the processing, the types of personal data, and the categories of data subjects. The processor must commit to:
Sub-processors need the controller's prior specific or general written authorization. Under a general authorization, the processor must announce additions or replacements and give the controller a chance to object, and it stays fully liable for each sub-processor's performance.
Under the California Consumer Privacy Act (CCPA) regulations at 11 CCR § 7051, a contract with a service provider must prohibit selling or sharing the data, name the specific business purposes for processing, prohibit use for any other purpose, require CCPA compliance, let the business verify compliance and stop unauthorized use, and require notice if the provider can no longer comply. A business that never enforces those rights may lose a defense if the provider misuses data. Updated regulations that took effect January 1, 2026 add obligations on risk assessments and automated decision-making, with some requirements phasing in through 2028 (DLA Piper).
Legal minimums are rarely the fight. These clauses are, and the table shows the positions controllers usually take.
| Clause | Controller-side position | Common red flag |
|---|---|---|
| Description of processing | Specific purposes, data types, and data subject categories | "To provide and improve the services" |
| Instructions | Processing only on documented instructions | Vendor may use data for its own product development or model training |
| Sub-processors | Current list attached, advance notice of changes, a right to object and to terminate | Changes posted on a web page with no notice and no objection right |
| Breach notification | A deadline in hours, plus the information needed to notify regulators | "Without undue delay" with no outside limit |
| Security measures | A specific annex that cannot be reduced during the term | A link to a security page the vendor can change |
| Audits | Third-party reports, plus direct audit rights after an incident | Access limited to the vendor's existing certifications |
| International transfers | A named transfer mechanism with completed annexes | Transfers anywhere the vendor or its sub-processors operate |
| Deletion and return | At the controller's choice, within a set period, with certification | Retention "in accordance with the vendor's policy" |
| Liability | Data protection breaches outside the general cap or under a higher cap | DPA breaches subject to the commercial agreement's general cap |
Under GDPR Article 33, a controller must notify the regulator without undue delay and, where feasible, within 72 hours of becoming aware of a breach. The processor's duty is only to notify the controller "without undue delay," with no fixed number of hours. A controller that accepts the statutory wording may learn about a breach after its own 72 hours have mostly run. That gap is why many controllers ask for 24 or 48 hours.
Most DPAs covering EU data rely on the 2021 EU standard contractual clauses, which come in four modules (controller to controller, controller to processor, processor to processor, and processor to controller). Check that the DPA picks the right module and completes the annexes. Transfers to US companies certified under the EU-US Data Privacy Framework can rely on its adequacy decision, which the EU General Court upheld in September 2025. An appeal is pending before the Court of Justice (WilmerHale), so many controllers keep the standard contractual clauses in place as a fallback.
| Task | Where AI helps | Where the lawyer decides |
|---|---|---|
| Checking required terms | Confirms each Article 28 and CCPA term against a rule list and flags gaps | Whether a gap matters for this processing |
| Applying your positions | Runs the playbook and proposes redlines for breach hours, audits, and sub-processors | When to accept a fallback for a strategic vendor |
| Reading the DPA with the main agreement | Answers questions about both documents attached to the chat, such as whether the liability cap covers DPA breaches | How hard to push on the carve-out |
| Transfers | Identifies the mechanism the DPA relies on and any missing annexes | Transfer risk for a specific country or vendor |
| Explaining changes to the vendor | Drafts counterparty-facing comments for each redline | Tone for a sensitive relationship |
Picture the only privacy lawyer at a 600-person healthcare software company with 14 vendor DPAs waiting at quarter end. On a normal Friday afternoon she would get through three.
She opens the first one in Word and runs her team's DPA playbook in Gavel Exec. Two rules fail: sub-processor changes are announced on a web page with no right to object, and breach notice is promised "without undue delay." She turns on Run with comments, so each redline arrives with a short, polite explanation addressed to the vendor. Then she attaches the master agreement to the chat and asks whether its liability cap applies to DPA breaches. It does, so she adds a carve-out.
The first DPA is back with the vendor before 5:15, and the queue is clear by midweek. What she likes most is that every redline arrives with its reasoning, so she can paste the explanation straight into her reply instead of writing it fourteen times.
Once every DPA runs through the same playbook, the next question is portfolio-wide: which of our vendors can add sub-processors without notice, and whose breach notice runs past 72 hours? Privacy teams increasingly want AI that answers those questions across every signed DPA at once. Recording each playbook result in a simple tracker gets a team most of the way there today, and it makes the eventual portfolio view far more useful.
Open the vendor's DPA in Word, attach the main agreement to the chat, and run a DPA playbook. Gavel Exec includes vendor-side and client-side data protection playbooks, and teams can generate their own from internal guidelines with AI Playbooks. Each rule is marked passed or failed with a link to the language, each proposed redline shows a priority level and its reasoning, and Exec can summarize the changes for the security or procurement team when you are done. Gavel Exec is SOC 2 Type II certified, Gavel has zero data retention agreements with its large language model (LLM) providers, and customer documents are not used to train models.
Related reading: AI contract review for IT managed services agreements and why manual review misses recurring risk.
For lawyers who negotiate DPAs in Microsoft Word, a Word-native tool such as Gavel Exec checks the draft against a DPA playbook, links each finding to the clause, and proposes tracked-change redlines. Privacy management platforms suit teams whose priority is tracking signed DPAs and sub-processor records across vendors.
Article 28(3) requires a description of the processing and processor commitments on documented instructions, confidentiality, security, sub-processors, assistance with data subject rights and compliance, deletion or return of data, and audits.
Without undue delay, with no fixed number of hours. Controllers usually negotiate a specific deadline, often 24 to 72 hours, so they can meet their own 72-hour obligation to regulators.
Transfers to US companies certified under the EU-US Data Privacy Framework can rely on its adequacy decision while a court challenge is pending. Transfers to uncertified recipients need another mechanism, most often the 2021 standard contractual clauses.
Yes. A playbook with one rule per Article 28(3) requirement lets Gavel Exec confirm each term is present and flag any that are missing or weaker than your position. A lawyer should still confirm the result.
This article provides general information and is not legal advice.
Guides to AI contract review by practice area, covering data privacy, IT managed services, IP licensing, construction, music, investment funds, procurement, and private equity.
How to review LPAs and side letters with AI: the LPA provisions LPs negotiate, how MFN elections work, an MFN tracker you can copy, and the 2026 regulatory context.
How to review music agreements with AI: a worked recoupment example, cross-collateralization, controlled composition at the 2026 mechanical rate, 360 deals, and the seven-year rule.
