Data processing agreement template
- Vendors still owed a signed agreement
- 7
- Share of the vendor list already covered, percent
- 36.4
- Companies in the chain once sub-processors are counted
- 44
- Vendors needing a transfer clause
- 5
The response deadlines come from the statutes themselves: California Civil Code § 1798.130(a)(2) and Regulation (EU) 2016/679, Article 12(3), both read on 2026-09-06. Everything else in the builders is your own count and the arithmetic shown beside each figure.
7. These are worked figures on a sample firm, not yours: change every one of them.
Download the Data processing agreement template worked example (CSV)
The vendor list is the part of privacy paperwork that nobody has finished, because the list is longer than anybody expects. This builder sizes it. Put in the vendors that touch personal data for you, how many already have a signed agreement, how many sub-processors each of them uses and how many move data overseas, and it prints how many are still owed an agreement and how many companies are in the chain once sub-processors are counted. The sample firm has 11 vendors, 4 covered, and 44 companies in the chain. Change every figure: the defaults are a worked example, not yours.
About the Data processing agreement template
Does a vendor's standard terms page count as a DPA?
Often yes: most serious vendors include one by reference and you accept it at sign-up. The test is whether you could produce it, dated, if asked. If you cannot find it in ten minutes it is not covering you in the meeting where it matters.
Why count sub-processors at all?
Because they are the chain your data actually travels down, and Article 28 of the GDPR puts conditions on a processor engaging another one. Eleven vendors with three sub-processors each is 44 companies, which is the figure people are surprised by and the reason a vendor register is a list rather than a memory.
What does the notice period change?
How much warning you get before the chain grows. A 30-day notice is a little over four weeks to object or leave; no notice period at all means the first you know is when you read the updated sub-processor page.
Where the constants in this tool come from
Regulation (EU) 2016/679, Article 28, processor obligations.
Regulation (EU) 2016/679, Article 30, records of processing activities.