# DATA PROCESSING AGREEMENT — ARTICLE 28 ASSESSMENT CHECKLIST

Document code: DPA-28-CHK-01 · Version 1.0 · Classification: Internal
Controller: ......................   Processor: ......................
Agreement date: ....../....../20....   Reviewer: ......................

SCORING:  [Y] present and adequate   [P] partial / needs wording   [N] missing

PART A — RELATIONSHIP AND SCOPE
[ ] A1 The parties and their roles (controller / processor) are identified.
[ ] A2 Subject matter, duration, nature and purpose of processing are set out.
[ ] A3 Types of personal data and categories of data subjects are listed.
[ ] A4 The agreement is in writing, including electronic form (Art. 28(9)).

PART B — THE EIGHT MANDATORY CLAUSES (Art. 28(3))
[ ] B1 (a) Processing only on the controller's documented instructions,
        including for transfers to a third country.
[ ] B2 (b) Persons authorised to process are under a duty of confidentiality.
[ ] B3 (c) All Article 32 security measures are undertaken.
[ ] B4 (d) Sub-processors: no engagement without authorisation (general or
        specific); the same data-protection obligations flow down by contract;
        the processor stays fully liable for its sub-processors.
[ ] B5 (e) The processor assists the controller in responding to data subject
        requests (Chapter III).
[ ] B6 (f) The processor assists with Articles 32-36 (security, breach
        notification, DPIA, prior consultation), given the information available.
[ ] B7 (g) On termination, data is deleted or returned at the controller's
        choice, and existing copies deleted unless retention is required by law.
[ ] B8 (h) The processor makes available all information needed to demonstrate
        compliance and allows and contributes to audits and inspections.
[ ] B9 The processor must tell the controller if an instruction infringes the
        GDPR or applicable data-protection law.

PART C — SUB-PROCESSORS (Art. 28(2) & (4))
[ ] C1 Authorisation model is stated (general with prior notice, or specific).
[ ] C2 A current sub-processor list / annex exists.
[ ] C3 Change-notification and objection mechanism is defined.
[ ] C4 Back-to-back data-protection obligations are imposed on each sub-processor.

PART D — INTERNATIONAL TRANSFERS (Art. 44 et seq.)
[ ] D1 Transfer locations (processor and sub-processors) are identified.
[ ] D2 A valid transfer tool is in place (adequacy / SCCs / BCRs).
[ ] D3 Standard Contractual Clauses, where used, are attached and completed.
[ ] D4 A transfer impact assessment exists where required.

PART E — SECURITY, BREACH, RECORDS
[ ] E1 Technical and organisational measures are described, not merely referenced.
[ ] E2 Breach notice to the controller is "without undue delay", with a timeline.
[ ] E3 The processor keeps records of processing on the controller's behalf (Art. 30(2)).
[ ] E4 Audit frequency, cost and method are workable, not merely nominal.

RESULT
Count of [N] / [P] items: ....   Priority gaps: ..............................
Owner for remediation: ..............   Target date: ....../....../20....

This checklist is general in nature and does not constitute legal advice.