Skip to main content
← All controls
GDPR Art. 28 / ISO 27701:2019 A.7.2.8 / NIST Privacy Framework PR.AT-2 GDPR / ISO/IEC 27701:2019

Are Data Processing Agreements (DPAs) in place for vendors processing personal data?

Demonstrate that all third-party vendors processing personal data operate under executed Data Processing Agreements that define data protection obligations, processing limitations, and security requirements in compliance with applicable privacy regulations.

Description

What this control does

Data Processing Agreements (DPAs) are legally binding contracts required under privacy regulations (GDPR, CCPA, etc.) that define the scope, purpose, and responsibilities when third-party vendors process personal data on behalf of the organization. These agreements establish data protection obligations, specify permissible data uses, outline security requirements, define breach notification procedures, and grant audit rights. Without valid DPAs, organizations face regulatory penalties, lose visibility into vendor data handling practices, and may be held liable for vendor data breaches or misuse.

Control objective

What auditing this proves

Demonstrate that all third-party vendors processing personal data operate under executed Data Processing Agreements that define data protection obligations, processing limitations, and security requirements in compliance with applicable privacy regulations.

Associated risks

Risks this control addresses

  • Vendor processes personal data outside the scope of authorized purposes, leading to unlawful secondary use or commercialization of customer information
  • Organization held liable for vendor data breach or unauthorized disclosure due to lack of contractual security obligations and indemnification clauses
  • Regulatory enforcement action and financial penalties for failure to establish required processor agreements under GDPR Article 28 or equivalent regulations
  • Vendor transfers personal data to unauthorized jurisdictions or sub-processors without proper legal mechanisms or data subject consent
  • Inability to exercise audit rights or verify vendor compliance with data protection requirements due to missing contractual provisions
  • Data subject rights requests (access, deletion, portability) cannot be fulfilled because vendor obligations are not contractually defined
  • Vendor retains personal data beyond necessary retention periods or fails to return/delete data upon contract termination due to absent data handling requirements

Testing procedure

How an auditor verifies this control

  1. Obtain the complete inventory of third-party vendors, service providers, and contractors from procurement, legal, and IT systems
  2. Identify which vendors process, store, or transmit personal data by reviewing data flow diagrams, system integrations, vendor questionnaires, and privacy impact assessments
  3. Request executed DPAs or data processing clauses embedded in master service agreements for all vendors identified as data processors
  4. Review each DPA for required elements: data processing scope and purpose, data categories and subject types, processing duration, security obligations, sub-processor provisions, breach notification requirements, audit rights, data return/deletion procedures, and cross-border transfer mechanisms
  5. Verify DPA execution dates precede the commencement of data processing activities and confirm signatures from authorized representatives of both parties
  6. Cross-reference DPA terms against applicable regulatory requirements (GDPR Article 28, CCPA, HIPAA BAA requirements, etc.) to confirm legal sufficiency
  7. Identify any vendors processing personal data without executed DPAs and document the gap, data volumes involved, and regulatory exposure
  8. Validate that sub-processor provisions exist and obtain evidence of sub-processor lists or prior written consent mechanisms where vendors engage downstream processors
Evidence required Collect executed DPA documents with signatures and dates for all in-scope vendors, vendor inventory spreadsheets annotated with personal data processing status, data flow diagrams or system integration documentation showing data shared with vendors, email correspondence or contract management system records demonstrating DPA negotiation and execution timelines, and vendor-provided sub-processor lists or notices. Capture screenshots from contract management platforms showing DPA status tracking and any identified gaps or missing agreements.
Pass criteria All vendors identified as processing personal data on behalf of the organization have executed Data Processing Agreements in place prior to data processing commencement, with agreements containing all required regulatory elements and no identified gaps in vendor coverage.