Data processing agreement template
- Vendors still owed a signed agreement
- 7
- Computed on this page from the inputs below
- Share of the vendor list already covered, percent
- 36.4
- Computed on this page from the inputs below
- Companies in the chain once sub-processors are counted
- 44
- Computed on this page from the inputs below
- Vendors needing a transfer clause
- 5
- Computed on this page from the inputs below
The response deadlines come from the statutes themselves: California Civil Code § 1798.130(a)(2) and Regulation (EU) 2016/679, Article 12(3), both read on 2026-09-06. Everything else in the builders is your own count and the arithmetic shown beside each figure.
Email me this result
We will send you these figures and a link back to them. One email, nothing else unless you tick the box.
7. Worked figures from a sample request, not yours: change every one of them.
Download the Data processing agreement template worked example (CSV)
The vendor list is the part of privacy paperwork that nobody has finished, because the list is longer than anybody expects. This builder sizes it. Put in the vendors that touch personal data for you, how many already have a signed agreement, how many sub-processors each of them uses and how many move data overseas, and it prints how many are still owed an agreement and how many companies are in the chain once sub-processors are counted. The sample firm has 11 vendors, 4 covered, and 44 companies in the chain. Change every figure: the defaults are a worked example, not yours.
Subject access requests: what people ask
Does a vendor's standard terms page count as a DPA?
Often yes: most serious vendors include one by reference and you accept it at sign-up. The test is whether you could produce it, dated, if asked. If you cannot find it in ten minutes it is not covering you in the meeting where it matters.
Why count sub-processors at all?
Because they are the chain your data actually travels down, and Article 28 of the GDPR puts conditions on a processor engaging another one. Eleven vendors with three sub-processors each is 44 companies, which is the figure people are surprised by and the reason a vendor register is a list rather than a memory.
What does the notice period change?
How much warning you get before the chain grows. A 30-day notice is a little over four weeks to object or leave; no notice period at all means the first you know is when you read the updated sub-processor page.
Where the constants in this tool come from
Regulation (EU) 2016/679, Article 28, processor obligations.
Regulation (EU) 2016/679, Article 30, records of processing activities.