Research and updates
Blog
DPAFlow updates and subprocessor monitoring notes.
Search
Showing 1–12 of 46.
Latest posts
2026-07-29 · gdpr
How to Create a Record of Processing Activities
The Article 30 field list is the easy part. This is the practical build: discovering the processing nobody wrote down, deciding what counts as one activity, running interviews that produce facts rather than guesses, and sequencing a first register so it becomes usable before it is finished.
2026-07-29 · subprocessors
When a Vendor Adds an AI Subprocessor: What Actually Changes
An AI provider added to a vendor's subprocessor list triggers the same Article 28 notice and objection rights as any other subprocessor. Four questions are specific to model processing: whether your data trains the model, how long it is retained, where inference happens, and whether output drives decisions about people.
2026-07-29 · dpa
When a Vendor Has a Data Breach: Your GDPR Notification Duties
Your processor owes you notification without undue delay; you owe the supervisory authority a decision within 72 hours. What counts as a breach, what awareness means, the two different notification thresholds, and the one contract clause that determines how much of your 72 hours you actually keep.
2026-07-29 · gdpr
RoPA vs DPIA: What Is the Difference and Which Do You Need?
A RoPA is an inventory of all your processing; a DPIA is a risk assessment of the high-risk parts, completed before that processing starts. What Article 30 and Article 35 each require, the five differences that matter, how to tell whether a DPIA is needed, and why vendor changes affect one document far more than the other.
2026-07-29 · gdpr
Records of Processing Activities: What Article 30 Actually Requires
What GDPR Article 30 requires in a record of processing activities, field by field, who the small-organisation exemption really covers, and why the recipient and third-country transfer fields go out of date without anyone in your organisation changing anything.
2026-07-29 · schrems-ii
When Is a Transfer Impact Assessment Required?
Whether you need a Transfer Impact Assessment depends on the transfer tool you rely on, not on the sensitivity of the data. A walkthrough of adequacy decisions, Article 46 safeguards, and Article 49 derogations, plus the subprocessor legs that pull transfers into scope unnoticed.
2026-07-25 · vendor-risk
How Privacy, Legal, Security, and Procurement Can Share Vendor Reviews
Vendor review needs four functions to agree, and it stalls in the handoffs rather than the analysis. Divide by decision rather than by document, fix the three handoffs that lose weeks, and keep one record with four views.
2026-07-25 · dpa
Data Processing Agreement vs Data Processing Addendum
Both terms describe a contract satisfying GDPR Article 28(3), and neither appears in the regulation. The difference is structural, and it changes four things worth checking: precedence, unilateral change, liability, and what happens to data at the end.
2026-07-25 · schrems-ii
Data Residency vs Data Location vs International Data Transfer
Three phrases used interchangeably that mean different things. A transfer can happen without data moving at all, because access is enough. What residency is still worth, and the four questions that produce usable answers.
2026-07-25 · schrems-ii
How to Verify a US Vendor's Data Privacy Framework Certification
A certification claim can remove the need for Standard Contractual Clauses, or be true in general and inapplicable to your transfer. Five checks: the entity, currency, scope, the receiving party, and whether a fallback exists.
2026-07-25 · subprocessors
How to Evaluate a Vendor's Subprocessor List Before Signing
A sub-processor list tells you who else touches your data and how honestly a supplier describes its chain. What a complete entry contains, the six gaps that matter, and how to turn the list into evidence you can still rely on later.
2026-07-25 · vendor-risk
GDPR Vendor Due Diligence Checklist
Article 28(1) lets you use only processors offering sufficient guarantees. This is the checklist for establishing that: scope, role, sub-processors, transfers, security, rights assistance, deletion, and the evidence file that proves you checked.
2026-07-25 · subprocessors
General vs Specific Authorization for Subprocessors Under GDPR
Article 28(2) permits prior specific or general written authorization. Both are lawful; they place the ongoing burden in different places. What each model means in practice, what to check in the notice terms, and which to negotiate for.
2026-07-25 · schrems-ii
International Data Transfer Checklist for SaaS Vendors
An eight-step operational checklist for a single vendor: establish whether there is a transfer at all, map destinations including access and backups, pick a mechanism per destination, check the clauses were completed, and record what invalidates the analysis.
2026-07-25 · vendor-risk
Vendor Discovery and Privacy Due Diligence in the Nordics
Norway and Iceland are in the European Economic Area, so transfers there are not restricted transfers. Once that is settled, Nordic vendor diligence turns on the chain behind a local supplier, sector scrutiny, and which language version you assessed.
2026-07-25 · vendor-risk
How to Prioritize Vendors for Privacy and Compliance Review
Reviewing every vendor to the same depth is not possible past a few hundred suppliers. Triage on processing rather than spend, use three tiers, define the escalation triggers that override them, and record the reasoning.
2026-07-25 · gdpr
Processor Audit Rights Under GDPR Article 28
Article 28(3)(h) contains two rights that behave very differently: a standing information right you will use constantly, and an inspection right that standard contracts narrow heavily. What each gives you, and what to negotiate.
2026-07-25 · vendor-risk
Vendor Risk Assessment Workflow for SaaS Procurement
Assess the processing, not the company. How to rate inherent exposure, weigh the control picture, express residual risk as a decision with a named owner, and define in advance what invalidates the assessment.
2026-07-25 · schrems-ii
Standard Contractual Clauses and Subprocessors: What to Review
The clauses are boilerplate; the annexes and the onward transfer provisions carry the substance. Which module applies, what defective annexes look like, how Clause 8.8 and the docking clause govern the chain, and what to check.
2026-07-25 · subprocessors
How to Handle a Subprocessor Objection
The objection right is procedural: it is worth what your ability to act inside the window is worth. How to assess a change, which grounds hold up, how to raise it, what remedies realistically exist, and what to record either way.
2026-07-25 · vendor-risk
Vendor Legal Review: A Practical Workflow for Privacy and Procurement Teams
A vendor legal review works when it starts early, examines the five provisions that decide lawfulness, ends in a decision with an owner, and leaves a record you can still defend a year later.
2026-07-25 · dpa
Vendor Offboarding: Data Return, Deletion, and Evidence
The contract ends and the data often stays. How to make Article 28(3)(g) operate: choose return or deletion, map every system that holds data, bound the backup carve-out, and obtain written confirmation you can file.
2026-07-25 · vendor-risk
How to Run a Privacy Review Before Vendor Onboarding
Privacy reviews usually fail on timing and ownership, not analysis. The five stages of an onboarding review, who owns each gate, what approval should actually mean, and the failure modes that make reviews ceremonial.
2026-07-25 · vendor-risk
Vendor Privacy Questionnaire: Questions to Ask Before Contracting
Most vendor privacy questionnaires are too long and ask questions that cannot discriminate between suppliers. The questions that earn their place, why each one works, and how to read the answers you get back.
2026-07-25 · gdpr
What Evidence Should You Retain From Vendor Reviews?
Keeping everything forever and keeping nothing both fail. How to set retention by purpose, why most of this material is not personal data, a workable schedule, and how to dispose of evidence defensibly without erasing former vendors.
2026-07-25 · dpa
What Is a Data Processing Addendum and When Do You Need One?
A Data Processing Addendum governs how a supplier may process personal data on your behalf. What the document does, the Article 28(3) content it must carry, when you need one, and when a supplier is not a processor at all.
2026-07-25 · gdpr
Audit-Ready Vendor Evidence
Accountability means being able to demonstrate vendor compliance, not just assert it. The evidence worth keeping, the qualities that make it audit-ready, and how dated captures reconstruct what a vendor disclosed on a given date.
2026-07-25 · vendor-risk
Build vs. Buy for Subprocessor Monitoring
A scraper, a diff, and an email looks like a weekend project. What breaks in production, what commercial tools cover, and a four-question framework for deciding whether to build or buy subprocessor monitoring.
2026-07-25 · gdpr
Controller, Processor, and Sub-processor: GDPR Roles Explained
Controller, processor, and sub-processor are distinct GDPR roles with different obligations. This guide explains each role with SaaS-shaped examples, covers joint controllership, and shows why classification matters.
2026-07-25 · vendor-risk
Fourth-Party Risk: The Vendors of Your Vendors
Your vendors' subprocessors are your fourth parties: organizations you never contracted with that may still hold your customers' personal data. Here is how GDPR Article 28(4) binds the chain, and how to map and watch it.
2026-07-25 · dpa
GDPR Article 28: What Data Processing Agreements Must Cover
GDPR Article 28 sets mandatory content for every data processing agreement. This guide walks through each required clause, the sub-processing rules, the Commission's optional standard clauses, and common gaps in vendor DPAs.
2026-07-25 · subprocessors
How DPAFlow Monitors Subprocessor Pages and Preserves Evidence
How DPAFlow works, step by step: a vendor watchlist, scheduled page checks, dated change evidence, email alerts, a review workflow, exportable proof, and the boundaries stated plainly.
2026-07-25 · subprocessors
How to Monitor Subprocessor Changes
Seven operational steps to monitor subprocessor changes under the GDPR: locate authoritative pages, record dated baselines, set cadence by criticality, detect diffs, triage, document decisions, and retain evidence.
2026-07-25 · vendor-risk
Manual Vendor Tracking in Spreadsheets
Why vendor tracking starts in spreadsheets, the failure modes that accumulate as vendors change subprocessors, the costs that surface at audit time, and the signals that you have outgrown manual tracking.
2026-07-25 · vendor-risk
A DPO's Recurring Vendor Review Workflow
One-time onboarding checks decay within a year. Here is a recurring vendor review workflow DPOs can actually run: triggers, a six-item agenda, who does what, evidence to keep, and how to right-size it for a small team.
2026-07-25 · gdpr
Keeping a RoPA Accurate as Vendors Change
Vendor and subprocessor changes are the main way Article 30 records drift out of date. What belongs in a RoPA, how entries silently go stale, and a maintenance loop that keeps the record aligned with reality.
2026-07-25 · schrems-ii
Schrems II in Practice for SMEs
What the Schrems II judgment decided, what the EU-US Data Privacy Framework changed, the transfer toolbox as it stands, and the concrete steps an SME using everyday SaaS should take, including the UK angle.
2026-07-25 · dpa
Sub-processor Change Notifications Under GDPR
General authorization, notice mechanics, and the right to object: how sub-processor change notifications work under GDPR Article 28, and how to keep a silent page change from becoming an unassessed authorization.
2026-07-25 · vendor-risk
Subprocessor Monitoring: The Complete Guide
The complete guide to subprocessor monitoring under the GDPR: why Article 28(2) makes it necessary, what to monitor, what good looks like, manual and automated approaches, and a four-stage maturity path.
2026-07-25 · vendor-risk
Subprocessor Monitoring Software Buyer's Checklist
A theme-by-theme checklist for evaluating subprocessor monitoring software: coverage, detection quality, evidence, alerting, workflow, records integration, vendor questions, red flags, and how to run a pilot.
2026-07-25 · schrems-ii
When a Subprocessor Moves Data Outside the EEA
When a processor adds or relocates a subprocessor outside the EEA, Chapter V applies to that leg too. The assessment sequence to run, the SCC contract mechanics, when to object, and how to document the decision.
2026-07-25 · schrems-ii
Transfer Impact Assessments: A Practical Walkthrough
A practical walkthrough of Transfer Impact Assessments: where the duty comes from, when you need one, the EDPB six-step method in practice, and how to keep TIAs current as vendors and subprocessors change.
2026-07-25 · gdpr
How to Build a Vendor and Subprocessor Inventory
Every GDPR vendor duty starts from one question: who has our data? Here is how to build a vendor and subprocessor inventory that answers it — scoping, minimal fields, collection sources, and the maintenance rhythm that keeps it true.
2026-07-25 · subprocessors
What Is a Subprocessor? Definition, Examples, and GDPR Obligations
A plain-language guide to subprocessors under the GDPR: what they are, how Article 28 governs them, how authorization and flow-down obligations work, and what controllers should do when a vendor's list changes.
2026-07-25 · subprocessors
Why SaaS Subprocessor Lists Change
Subprocessor lists change for operational reasons that rarely wait for contract renewals. Here is what drives the churn, why page formats vary so much, and why silent changes matter for controllers.
2026-07-25 · dpa
DPA Review Checklist Before Signing
A clause-by-clause checklist for the sub-processing terms of a DPA: authorization model, notice and objection mechanics, list location, notification channel, flow-down, transfers, audit rights, and what to operationalize after signing.
Categories
Monitor subprocessor changes before they become audit work.
See how DPAFlow turned vendor changes into dated, review-ready Article 28 evidence.