Data Processing Agreement Red Flags: Six Clauses to Check Before You Sign
This page is general information, not legal advice.
A data processing agreement (DPA) sets the rules for how a vendor handles personal data on your behalf. That data might be your customers' emails, your staff records or your clients' files. Small businesses usually get the vendor's standard DPA as an attachment to a software or service contract, often as a click-through. It's easy to treat it as paperwork. But if something goes wrong with that data, your customers and regulators will usually look to you first, and the DPA decides how much help you get from the vendor. This page covers six clauses that often move risk onto the business that owns the data. For each one you get an illustrative example, why it matters, and wording you can propose. Data protection rules vary a lot by jurisdiction, and some laws set minimum terms a DPA has to include.
The example clauses below are illustrative. They are not taken from any real company's agreement.
1. Sub-processors added without real notice
A typical clause might read: "Processor may engage sub-processors at its discretion. A current list is available on Processor's website and may be updated from time to time."
Why it works against you
Your data can end up with companies you have never heard of, in places you didn't expect. "Available on our website" puts the job of checking on you, and it gives you no right to object if you don't like a new sub-processor. If a sub-processor mishandles the data, the clause may not even say the vendor stays responsible for it. See subcontracting clauses explained.
What to ask for instead
Sample wording to propose: "Processor will give Customer at least [X] days' written notice before adding or replacing a sub-processor. Customer may object on reasonable grounds, and if the parties cannot resolve the objection, Customer may terminate the affected services and receive a refund of prepaid fees. Processor remains fully responsible for the acts and omissions of its sub-processors."
2. Vague or slow breach notification
A typical clause might read: "Processor will notify Customer of a confirmed Security Incident within a commercially reasonable time and as required by applicable law."
Why it works against you
"Confirmed" lets the vendor investigate for as long as it likes before telling you. "Commercially reasonable" has no clock attached. Many data protection laws give the business that owns the data its own deadline to notify regulators or affected people, and you can't meet it if you don't know. The clause also says nothing about what information you'll get or whether the vendor will help.
What to ask for instead
Sample wording to propose: "Processor will notify Customer without undue delay, and in any event within [X] hours, after becoming aware of a suspected or actual Security Incident affecting Customer Data. The notice will describe the nature of the incident, the data affected and the steps taken, and Processor will provide updates and reasonable assistance with Customer's notification duties."
3. The vendor can use your data for its own purposes
A typical clause might read: "Processor may use Customer Data, including in aggregated or de-identified form, to operate, improve and develop its products and services."
Why it works against you
A processor is supposed to act on your instructions. A clause like this lets the vendor treat your customers' data as a resource for its own business, which may include analytics or training its own models. "De-identified" is often undefined. It may also put you in breach of the promises you made in your own privacy policy. See data ownership clauses explained.
What to ask for instead
Sample wording to propose: "Processor will process Customer Data only on Customer's documented instructions and only to provide the services. Processor will not use Customer Data to develop or train products, models or services, or for any other purpose, without Customer's prior written consent."
4. A liability cap that swallows data breaches
A typical clause might read: "Processor's total liability under this DPA and the Agreement shall not exceed the fees paid by Customer in the twelve (12) months preceding the claim."
Why it works against you
For a small business on a low monthly plan, that cap might be tiny compared with the cost of handling a breach: notifying customers, getting legal help, dealing with regulators and losing trust. Many DPAs simply point to the main contract's cap, so the vendor's exposure for losing your data is the same as for a late invoice. Look for any indemnity too, and check which way it runs. See limitation of liability clauses explained and indemnification clauses explained.
What to ask for instead
Sample wording to propose: "The liability cap does not apply to Processor's breach of its data protection or security obligations, or, if a cap must apply, such liability is subject to a separate cap of [X times] the annual fees. Processor will indemnify Customer for losses arising from Processor's breach of this DPA."
5. Audit rights that exist only on paper
A typical clause might read: "Customer's audit rights are satisfied by Processor providing a summary of its most recent third-party certification. Any other audit shall be at Customer's expense, no more than once every three years."
Why it works against you
You may be required to show that you checked your vendors properly. A summary report may not cover the service you actually use, and limits like these can stop you checking even after an incident. If the vendor also gets to charge whatever it likes for an audit, the right becomes useless for a small business.
What to ask for instead
Sample wording to propose: "Processor will provide its current security certifications and reports on request and answer Customer's reasonable security questionnaires. Customer may conduct an audit after a Security Incident or where required by a regulator, and Processor will bear its own costs of cooperating."
6. No clear deletion when the contract ends
A typical clause might read: "Upon termination, Processor will delete or return Customer Data in accordance with its standard retention policies."
Why it works against you
"Standard retention policies" can mean months or years, and they can change without notice. Backups are often left out entirely. You may also lose the chance to export your data before it's gone, which matters if you're switching vendors. Check how the main contract handles ending the deal, too. See SaaS subscription agreement red flags.
What to ask for instead
Sample wording to propose: "On termination, Processor will, at Customer's choice, return Customer Data in a common machine-readable format or delete it within [X] days, including from backups within a defined backup cycle, and will confirm deletion in writing on request, unless law requires retention."
Also worth a look
Check where the data will be stored and moved, and what safeguards apply to transfers across borders. Look for a security annex that only says "industry standard" measures with no detail. Check whether the vendor can change the DPA unilaterally, and which country's law and courts govern disputes (see governing law and jurisdiction clauses explained). If you're the one processing data for your own clients, read their DPA with the same care, because the same clauses can run against you.
Scan your own DPA free
Every vendor's DPA is different, and one vague phrase can change who carries the risk. Upload your data processing agreement to the ScanMyTerms terms of service checker as a PDF, DOCX, TXT or MD file, or photograph it. In about a minute you get a list of clauses that work against you, with the risk level, the exact wording, why it hurts and how to change it. The free preview needs no sign-up and shows the risk count and the first two findings. The full report is $5. ScanMyTerms does not use your documents to train AI models, and reports are deleted after 7 days.
This page is general information, not legal advice. Data protection rules vary by jurisdiction, so for decisions about a specific agreement, talk to a qualified lawyer where you do business.
Sources
- All clause examples on this page are illustrative and written for this guide. They are not quoted from any real company's agreement.