DPA readiness checklist

You know what personal data flows through which systems and why — even if it is a simple register, not a 200-row template.

Every company that processes personal data on your behalf is named with category, region, and owner.

Article 28 requires a contract covering subject matter, duration, nature and purpose, data types, and obligations.

When a customer asks “list your sub-processors”, you can answer same-day from a maintained list.

When you add or replace a processor, affected customers are informed per your DPA / Art. 28(2).

You know who to email at each vendor for incidents, DSARs, and questionnaire follow-ups.

Signed DPAs and SOC 2 / ISO certificates have review dates — not only a folder from three years ago.

72-hour controller notification and processor-to-controller escalation paths are written down.

Access and deletion requests have owners, due dates, and a checklist of systems to touch.

ChatGPT, Copilot, and similar tools are listed with training-on-data flags — shadow AI is not invisible.

US or other non-EEA processors have SCCs or another transfer mechanism noted in the register.

Someone is accountable for refreshing the list before the next security questionnaire lands.