Covenant Advisory Group — SaaS DPA Red-Flag Checklist

Red-Flag Checklist

Issue	Why It Matters	Preferred / Mitigations
Role and Scope Ambiguous or shifting roles (controller / processor / sub-processor).	Misallocates GDPR / CCPA obligations, creates liability uncertainty, and complicates audits.	Explicitly state roles for all parties; define processing as limited to documented lawful instructions; address joint controllership separately in a dedicated agreement.
Processing Instructions Broad “necessary for business purposes” clause or unilateral vendor right to change instructions.	Permits scope-creep and processing outside the customer’s control.	Restrict processing to documented instructions in the DPA and order forms; require written approval for material changes.
Data Categories & Purpose Unbounded “any data provided” and vague purposes.	Expands exposure and undermines DPIAs and transfer assessments.	Enumerate data categories, data-subject types, purposes, and retention; prohibit unrelated secondary use without explicit approval.
Sensitive / Special Categories Permission to process special-category data without safeguards.	Increases regulatory exposure and breach impact.	Prohibit processing of special-category data unless expressly agreed with additional safeguards and legal basis.
Combining / Deriving Data Vendor may aggregate or derive insights using customer data without restriction.	Risks re-identification, IP leakage, and confidentiality erosion.	Allow aggregation only for robustly anonymised data; forbid re-identification; preserve customer IP ownership.
AI / ML Training Broad right to use customer data for model training.	Creates confidentiality, IP, and privacy risk including downstream model reuse.	Disallow training on identifiable data; require opt-in, strong anonymisation, purpose limits, and disclosure of model usage.
Sub-processors Unrestricted appointment without notification or audit rights.	Introduces shadow-IT risk and unknown data flows.	Maintain a published sub-processor list; give prior notice / objection rights; require equivalent obligations and due-diligence checks.
International Transfers Transfers rely on obsolete mechanisms or self-assurances.	Non-compliance post-Schrems II and enforcement exposure.	Use valid SCCs 2021 / 2023; document TIAs; apply supplementary technical measures.
Government Access Vague cooperation or no obligation to challenge requests.	Enables over-disclosure and conflicts with SCCs or local laws.	Require narrow disclosures under legal compulsion only; notify customer where lawful; commit to challenge over-broad requests.
Security Measures Generic “industry standard” with no annex.	Makes compliance unverifiable and weakens enforcement.	Attach a detailed security-controls annex aligned with ISO 27001 / SOC 2; define technical & organisational measures.
Encryption No encryption at rest or in transit; poor key management.	Increases breach probability and regulatory penalty exposure.	Mandate TLS in transit, AES-level encryption at rest, strong key-management standards, and customer-managed keys where feasible.
Access Controls Shared accounts; no MFA or activity logging.	Enables unauthorised access and hampers forensics.	Apply least-privilege access, enforce MFA for privileged users, maintain logs and regular reviews.
Vulnerability Management No patching SLAs or penetration-testing cycle.	Creates cumulative security debt and exploitable vulnerabilities.	Require periodic testing, defined patching SLAs, and remediation timelines based on severity.
Incident Response Notification “without undue delay” with no time cap.	Delays regulatory reporting and customer mitigation efforts.	Require notice within 48–72 hours including specified content, updates, and post-incident report.
Liability Cap Processor’s total liability capped to 12-month fees.	Leaves insufficient coverage for major breaches or misconduct.	Carve out uncapped / super-cap buckets for data-breach, confidentiality, IP-infringement, and willful misconduct; increase overall cap to a multiple of fees.
Indemnities No indemnity for data-protection breaches; customer indemnifies vendor broadly.	Creates asymmetric risk allocation and leaves customer exposed for vendor-caused violations.	Adopt mutual, balanced indemnities including vendor indemnity for security incidents and data-law non-compliance.
Insurance No cyber-liability insurance or proof of coverage.	Removes financial backstop for high-impact incidents.	Maintain suitable cyber-liability insurance and provide certificates on request.
Sub-processing Outside EEA / UK / CH Use of weaker local laws; no SCC / IDTA flow-down.	Creates non-compliant international transfers and enforcement risk.	Flow down SCCs / IDTA and equivalent obligations; implement technical safeguards and document TIAs.
Confidentiality Broad internal sharing; contractors not bound by confidentiality.	Raises insider and leakage risk.	Restrict access to need-to-know; bind all staff / contractors by confidentiality and security obligations.
Purpose Limitation Default use for analytics, product improvement, or marketing.	Leads to function creep and unlawful secondary use.	Require explicit opt-in for secondary uses; allow only aggregated / anonymised data with safeguards.
Data Location “Global” processing with no residency options.	Causes data-sovereignty and compliance issues for regulated sectors.	Specify primary regions and provide residency options where feasible.
Business Continuity / Disaster Recovery No RTO / RPO commitments; single-region dependency.	Creates prolonged outage risk and potential data loss.	Define RTO / RPO targets; maintain multi-region backups; test DR plans regularly.
Termination Assistance None offered or charged at unreasonable rates.	Prevents orderly customer exit or transition.	Provide reasonable, time-limited assistance at pre-agreed rates.
Conflicts & Precedence DPA subordinate to master agreement on privacy matters.	Nullifies negotiated privacy protections.	Ensure the DPA prevails where conflicts arise on data-protection or security topics.
Changes to DPA Vendor may amend unilaterally.	Allows erosion of negotiated protections without consent.	Require prior notice and customer consent for material changes; permit termination for adverse revisions.
Processor Personnel No background screening or training obligations.	Introduces insider and non-compliance risk.	Mandate appropriate screening consistent with law and recurring privacy / security training.
Privacy by Design No commitment to minimisation or segregation.	Encourages over-collection and cross-tenant exposure.	Adopt privacy-by-design principles including minimisation, pseudonymisation, and tenant isolation.
Logs and Monitoring Logs kept indefinitely or broadly shared.	Creates unnecessary retention and privacy creep.	Define retention limits; restrict access; redact personal data in logs where possible.
Children’s Data No special handling or prohibition.	Raises compliance and reputational risk under COPPA / GDPR Art 8.	Prohibit processing of children’s data unless expressly agreed with safeguards and verified lawful basis.
High-Risk Processing No assistance with DPIAs or LIAs.	Leaves controller non-compliant for high-risk operations.	Require vendor assistance with DPIAs / LIAs and security questionnaires on a reasonable-efforts basis.
Regulatory Cooperation Only “commercially reasonable” effort with no timelines.	Delays responses to regulators and increases fine exposure.	Commit to prompt, defined-timeline cooperation where lawfully permitted.
Cookies / Trackers Third-party trackers embedded by default.	May violate consent rules and leak user data externally.	Disclose all trackers; enable consent mechanisms; provide tracker-free logged-in operation.
Anonymisation Claims “Anonymised” not defined or based on recognised standards.	Enables re-identification risk and undermines compliance posture.	Define anonymisation to recognised standards; expressly prohibit re-identification.
Data Quality No tools or APIs to maintain data accuracy.	Prevents controller from meeting accuracy obligations under GDPR Art 5(1)(d).	Provide update, correction, and deletion mechanisms for inaccurate data.
Third-Party Requests Vendor may comply with requests without customer approval.	Creates unauthorised disclosure risk.	Notify and require customer consent unless legally prohibited; disclose minimum data necessary.
BYO Integrations No control over marketplace apps or webhooks.	Unvetted integrations expand uncontrolled data flows and compliance exposure.	Document integrations; require DPAs with integration partners; allow disabling unsafe connectors.
Open-Source / Telemetry Collection of telemetry including content data.	Introduces privacy and IP risk through excessive instrumentation.	Limit telemetry to non-content metadata; exclude customer content; provide opt-outs and documentation.
Export Controls / Sanctions No contractual export-control or sanctions commitments.	Creates legal exposure under national and international trade regimes.	Contractually commit to comply with export-control and sanctions laws; restrict access from embargoed territories.
Sectoral Laws Silent on HIPAA / GLBA / PCI or other sector frameworks.	Causes non-compliance for regulated customers.	Provide sector-specific addenda or confirm inapplicability; implement required safeguards.
Records of Processing No assistance maintaining RoPA.	Creates a compliance gap for controllers relying on vendor data.	Maintain legally required records and share summaries on request.
Data Ownership Vendor claims ownership of customer data or derivatives.	Transfers intellectual-property and confidentiality risk to vendor.	Customer retains ownership; vendor obtains limited licence solely to deliver services; derivatives only if truly anonymised.
Fees for Compliance Excessive charges for standard assistance obligations.	Increases cost unpredictability and discourages compliance.	Include ordinary assistance in base fees; charge only for extraordinary work at agreed rates.
Notices and Contacts No defined privacy / security contact points.	Causes delay in incident escalation and regulatory notice.	Provide named contacts, escalation paths, and 24×7 notification channels.
Training and Awareness Omission of privacy / security-training requirements.	Increases human-error likelihood and breach probability.	Require regular privacy and security training for relevant personnel and contractors.
Supervisory Authority Orders Vendor may ignore or delay compliance.	Exposes customer to enforcement action and fines.	Commit to comply with final, binding regulator orders and notify customer promptly.
Anti-Assignment / Change of Control Broad vendor right to assign or change control without notice.	Customer data could be transferred to an unknown entity or jurisdiction without approval.	Require prior written notice and allow termination for any adverse change of control or assignment.
Data Portability No export capability or only proprietary formats.	Creates vendor lock-in and hinders lawful portability or transition.	Provide exports in common, interoperable formats (CSV, JSON, XML) with documentation of schema and data scope.
Pseudonymisation Not supported for non-production environments.	Raises risk when data is reused for testing or analytics.	Implement pseudonymisation or masking in lower environments and analytics datasets.
Testing Environments Real customer data used in development or QA systems.	Exposes personal data outside controlled production safeguards.	Require synthetic or masked data in all non-production environments; segregate networks and credentials.
Key Personnel Access Privileged offshore contractor access without equivalent controls.	Introduces transfer and insider risk.	Document access locations; ensure equal technical and contractual safeguards; apply transfer mechanisms where required.
Metrics and Reporting No defined security or compliance reporting cadence.	Prevents oversight and early-warning of issues.	Provide periodic metrics (patch SLAs, incidents, training completion, DPIA support) to customers.
Onward Transfer by Customer Vendor restricts lawful exports or disclosures by customer.	Restricts customer’s compliance flexibility and creates lock-in.	Permit customer-controlled exports consistent with contract and law; clarify transfer responsibility post-export.
Localisations No UK or Swiss addenda; outdated SCCs.	Invalidates transfer mechanisms for non-EEA jurisdictions.	Include UK IDTA / Addendum and Swiss clauses; update SCCs promptly after regulatory changes.
Schrems II Supplementary Measures No technical safeguards beyond SCCs.	Fails to satisfy EDPB expectations for high-risk transfers.	Adopt encryption with customer-held keys, split-processing or equivalent strong technical controls.
Data Minimisation Vendor collects more data than necessary for services.	Violates GDPR Art 5(1)(c) and increases exposure surface.	Collect and process only required data fields; provide configuration options to minimise collection.
Processor → Sub-Processor Flow-Down Weak or missing flow-down obligations.	Breaks the compliance chain and leaves gaps in accountability.	Impose equivalent or stronger contractual obligations on all sub-processors; retain vendor liability for their acts.
Return / Deletion in Backups Deletion from backups not addressed.	Residual personal data may persist indefinitely, breaching deletion commitments.	Define backup-retention windows and secure-deletion timelines; ensure verifiable purge after expiry.
Audit Scope Physical-site audits only; remote review excluded.	Restricts verification and increases cost of compliance.	Allow remote document and controls review under confidentiality; reserve site visits for justified circumstances.
Financial Distress No data-escrow or continuity plan if vendor fails.	Risk of permanent data loss or service outage on insolvency.	Include data-export and continuity assistance clauses; consider escrow for critical services.
Governing Law / Jurisdiction Non-privacy-friendly governing law or forum.	Reduces enforceability of data-protection obligations.	Select jurisdiction aligned with data-subject protection laws (e.g., EU / UK) and accessible dispute-resolution forums.
Order Form Conflicts Order forms silently override DPA terms.	Erodes negotiated privacy and security protections.	Specify that the DPA prevails on privacy and security; require explicit amendment for any variance.

SaaS Data Processing Agreement Red-Flag Checklist

Disclaimer

Red-Flag Checklist

Practical Use & Escalation

Disclaimer

About Covenant Advisory Group