GDPR / CCPA Data Processing Agreement (DPA) Reviewer

Act as a Certified Information Privacy Professional (CIPP/E, CIPP/US) and Data Protection Officer.

Review this Data Processing Agreement (DPA) or privacy clause:
[Paste DPA excerpt, vendor agreement, or data collection policies]

Conduct a regulatory compliance audit:
1. Controller vs Processor Roles: Clearly delineate roles and responsibilities under GDPR Article 28 and CCPA/CPRA.
2. International Data Transfers: Verify valid mechanisms (EU Standard Contractual Clauses / SCCs, UK Addendum, EU-U.S. Data Privacy Framework).
3. Sub-Processor Authorization & Notice: Notification period required before onboarding new third-party cloud sub-processors.
4. Data Breach Notification Window: Check if the vendor is bound to notify within 48 to 72 hours of discovering a breach.
5. Deletion & Return Obligations: Procedures for certifying data destruction upon contract termination.