A GDPR data processing agreement (DPA) checklist covers the seven mandatory elements under Article 28(3): subject matter and duration of processing, the nature and purpose of processing, types of personal data, categories of data subjects, the processor's obligations, sub-processor rules, and audit rights. Miss the sub-processor flow-down clause and you've got a contract that looks compliant on page one but fails the moment a vendor hires a cloud host you never vetted.
Why this matters
A missing or thin DPA is one of the easiest things for a regulator, an enterprise procurement team, or an insurer to catch. It's a document check, not a technical audit — which means gaps get found fast.
UK GDPR enforcement can reach £17.5 million or 4% of global annual turnover, whichever is higher. Most DPA failures never get that far, but a bad clause still costs you the deal when a client's legal team flags it during contract review.
Running your own record of processing activities alongside your DPA checklist gives you one consistent map of who processes what, which makes the DPA itself far quicker to draft and defend.
What must a GDPR data processing agreement checklist include?
Every DPA between a controller and a processor needs the same seven clauses, regardless of company size or sector. Here's the breakdown against Article 28(3):
| Clause | What it must state |
|---|---|
| Subject matter and duration | What's being processed and for how long the agreement runs |
| Nature and purpose | Why the processing happens — the business reason, not a vague catch-all |
| Type of data and data subjects | Categories of personal data and whose data it is (employees, customers, patients) |
| Processor obligations | Confidentiality, security measures, deletion or return of data at contract end |
| Sub-processor rules | Written authorisation required before engaging any sub-processor, plus flow-down of the same terms |
| Assistance duties | Processor must help the controller respond to data subject requests and breach obligations |
| Audit rights | Controller's right to audit or inspect, and processor's duty to demonstrate compliance |
A checklist built from this table catches the two things generic templates usually skip: sub-processor flow-down and audit rights. Both get flagged constantly in 2026 vendor security reviews.
Building the checklist step by step
- Map every processor relationship — list every vendor touching personal data, not just the obvious ones like payroll or CRM.
- Confirm a written DPA exists for each processor — verbal assurance or a privacy policy link doesn't count.
- Check for the seven Article 28(3) clauses in each existing agreement.
- Flag missing sub-processor authorisation — this is the clause most contracts get wrong.
- Set a review cadence — annually at minimum, or whenever a processor changes its sub-processor list.
- Log the outcome against your record of processing activities so DPA status and processing purpose sit in one place.
Why DPA requirements vary between processors
Not every processor relationship carries the same risk, which is why a one-size checklist misses things. Factors that change what your DPA needs to cover:
- International transfers — a processor storing data outside the UK or EEA needs a transfer mechanism (SCCs or UK IDTA) bolted onto the DPA.
- Sub-processing depth — a processor that uses its own sub-processors (most SaaS vendors do) needs explicit flow-down language.
- Sector-specific rules — health data, financial data, and children's data all carry extra obligations beyond the base seven clauses.
- Existing certifications — a processor holding ISO 27001 or SOC 2 can usually evidence the security clause faster, but the DPA still has to name the standard and scope.
- Contract format — some DPAs sit as a standalone document, others as an addendum inside a master services agreement; both are valid as long as the seven clauses appear somewhere binding.
Where sub-processors are involved, cross-check the DPA against your own data protection impact assessment for that processing activity — a DPIA often surfaces a sub-processor risk the contract team never flagged.
Do I need a DPA with every processor?
Yes — any third party processing personal data on your behalf needs a written DPA under Article 28(3), with no exception for small volumes or short engagements. A freelance bookkeeper handling payroll data needs one just as much as a cloud hosting provider.
What happens if a DPA is missing or incomplete?
A missing DPA is a direct compliance gap that regulators, auditors, and enterprise procurement teams check for by name in 2026. It won't trigger an automatic fine on its own, but it removes your legal basis for using that processor and becomes the first thing flagged in a security questionnaire or contract review.
Can one person own the DPA checklist, or does it need a DPO?
One person can own the checklist without holding the formal Data Protection Officer role, unless your organisation meets the criteria requiring a DPO (large-scale monitoring or special category data processing). If you're borderline, the DPO appointment guide walks through the trigger conditions.
Tracking DPA status by hand in a spreadsheet works until you hit ten or twelve processors — after that, renewal dates and sub-processor changes start slipping. OneClickComply keeps DPA tracking next to your other compliance evidence, so a missing clause shows up before a client's procurement team finds it.
Automate your compliance evidence tracking
Keep DPAs, DPIAs, and audit evidence in one record.
Frequently asked questions
One last thing
The sub-processor clause is the one auditors ask about first in 2026, because it's the fastest way to check whether you actually read your own contracts or just copied a template. Pull every processor agreement you have and search for the word "sub-processor" — if it's not there, that agreement fails the checklist regardless of how polished the rest of it reads.