# Data Processing Agreement Workflow Reference

## DPA Lifecycle Workflow

### Phase 1: Processor Identification and Due Diligence

1. **Identify processor relationship**: Determine whether the third party is a processor (acts on controller's instructions) or a separate controller (determines its own purposes).
2. **Due diligence assessment**: Evaluate the processor's data protection capabilities:
   - Security certifications (ISO 27001, SOC 2 Type II)
   - Privacy certifications (ISO 27701)
   - Technical and organisational measures documentation
   - Sub-processor transparency
   - Breach history and incident response capabilities
   - Geographic location of processing
3. **Risk classification**: Rate the processor as high, medium, or low risk based on data volume, sensitivity, access scope, and geographic factors.
4. **Approval**: High-risk processors require DPO approval before engagement.

### Phase 2: DPA Drafting and Negotiation

1. **Select template**: Use the organisation's standard DPA template containing all Art. 28(3) mandatory elements.
2. **Populate specifics**: Complete the schedule/annexes with processing-specific details:
   - Subject-matter and duration
   - Nature and purpose of processing
   - Types of personal data
   - Categories of data subjects
   - Technical and organisational measures
   - Sub-processor list (if general authorisation)
3. **Negotiate key terms**:
   - Audit rights: Push for on-site audit rights, not just acceptance of third-party certifications
   - Sub-processor notification: Minimum 30 days advance notice
   - Breach notification: Specific timeline (24-48 hours)
   - Data deletion: Certified deletion within 30 days of contract termination
   - Liability: Proportionate to the processing risk
4. **International transfer provisions**: If the processor or sub-processors transfer data outside the EEA, incorporate SCCs (Module Two) or confirm adequacy decision coverage.
5. **Legal review**: Both parties' legal teams review the final draft.
6. **Execution**: Sign the DPA before processing begins.

### Phase 3: Ongoing Monitoring

1. **Sub-processor monitoring**: Review sub-processor change notifications and exercise objection rights where appropriate.
2. **Security verification**: Request updated security documentation annually (SOC 2 reports, pen test summaries, ISO certifications).
3. **Audit programme**: Conduct processor audits on a risk-based schedule:
   - High-risk processors: Annual audit (on-site or detailed questionnaire)
   - Medium-risk: Biennial audit
   - Low-risk: Triennial or reliance on certifications
4. **Breach response coordination**: Test breach notification procedures annually through joint tabletop exercises for high-risk processors.
5. **Performance review**: Assess processor compliance as part of the annual vendor review.

### Phase 4: Contract Termination

1. **Data handling instructions**: Notify the processor whether data should be returned or deleted.
2. **Verification**: Obtain written certification of data deletion within 30 days.
3. **Audit closure**: Conduct a final audit or obtain a final compliance attestation.
4. **Record keeping**: Retain the DPA and all related records for the statutory limitation period (typically 3-6 years depending on jurisdiction).

## Sub-Processor Management Workflow

1. **Receive notification**: Processor informs controller of intended sub-processor addition/change.
2. **Assess the sub-processor**: Review the sub-processor's data protection capabilities, location, and relevance.
3. **Decision**:
   - **Approve**: Confirm in writing.
   - **Object**: Provide written objection within the notification period. The DPA should specify the consequences of objection (typically the right to terminate without penalty).
4. **Verify flow-down**: Confirm that the processor has imposed the same Art. 28 obligations on the sub-processor.
5. **Update records**: Update the processor register and RoPA with the new sub-processor.

## DPA Review Triggers

- Contract renewal or extension
- Material change to the processing (new data types, new purposes, new geographies)
- Change in applicable law or regulatory guidance
- Processor security incident or breach
- Sub-processor change that materially affects the processing
- Annual review cycle (for high-risk processors)
- Supervisory authority audit or investigation