Enterprise customers will ask for a DPA before they share any personal data with you. We prepare a DPA that covers GDPR, UK and US state privacy requirements, with a subprocessor list and transfer terms ready to go. When a customer sends their own version, we help you review it quickly and push back where it matters.
At a glance
- Practice
- Privacy
- Pricing
- Flat fee, quoted before we start
- Included
- 6 deliverables
- Process
- 3 steps, one named attorney
- Where we work
- Slack, email or a call
When founders call us
The moments that usually bring a company to us for this work.
- 01
Your first enterprise customer's procurement team has asked for your DPA
- 02
A customer sent their own DPA with audit rights and unlimited liability
- 03
You process personal data from EU or UK customers and need transfer terms
- 04
You added a new subprocessor and need to notify customers
What you get
Scoped in writing before we start. One flat fee for all of it.
- Standard DPA covering GDPR, UK GDPR and US state privacy law requirements
- Standard Contractual Clauses and UK addendum for international transfers
- Subprocessor list template and change notification process
- Security measures annex drafted with your engineering team
- Review and redline of customer-provided DPAs
- Negotiation playbook for common customer requests
How it works
- 1
Data flow review
We confirm what personal data you process for customers and which subprocessors you use.
- 2
Draft DPA
We prepare your DPA, annexes and subprocessor list.
- 3
Negotiation support
We help you respond to customer redlines and keep positions consistent across deals.
Mistakes we help you avoid
The ones we see most often, and catch before they cost you.
- Avoided
Signing customer DPAs with uncapped liability for data breaches
- Avoided
Promising security measures your team has not actually implemented
- Avoided
Using subprocessors that are not disclosed to customers
- Avoided
Missing a valid transfer mechanism for EU personal data sent to the US
Data Processing Agreements (DPA): questions founders ask
It is a contract between a company that controls personal data and a vendor that processes it on the company's behalf. GDPR Article 28 requires specific terms, such as processing only on instructions, confidentiality, security and subprocessor controls. Several US state laws impose similar contract requirements for service providers.
If you process personal data on behalf of business customers, they will likely require one, especially if GDPR or state privacy laws apply to them. Having your own template ready saves time and gives you a stronger starting position.
They are model clauses approved by the European Commission for transferring personal data from the EU to countries without an adequacy decision. US companies can alternatively self-certify under the EU-US Data Privacy Framework. Many DPAs include SCCs as a fallback either way.
Large customers often insist on their own paper. That can work if the terms match how your service operates. We review it against your practices and flag terms like broad audit rights or uncapped liability that are worth negotiating.
Get a flat-fee quote for Data Processing Agreements (DPA).
A short call with an attorney. You leave with a written scope and one fixed price.
Book a call