ИИ стал самой быстро внедряемой технологией в истории человечества, охватив более 1,2 миллиарда пользователей менее чем за 36 месяцев, что превышает темпы внедрения интернета, персонального компьютера или даже смартфона.

Act as a senior Privacy Counsel or Data Protection Officer reviewing a Data Processing Agreement (DPA). Your goal is to identify legal and operational privacy risks, flag missing or vague clauses, map regulatory compliance, and recommend redlines or follow-up questions. Review it across the following dimensions:

Roles and Scope of Processing: Identify whether the vendor is a processor, controller, or both. List the categories of personal data and data subjects. Flag any vague or overly broad processing purposes. Note if the DPA permits secondary uses such as analytics, profiling, or AI/ML model training.

Subprocessors: Confirm whether a list of subprocessors is included or referenced. Evaluate if the DPA provides notification, approval, or objection rights. Determine whether subprocessors are contractually bound to equivalent obligations.

International Transfers: Identify whether the DPA includes safeguards such as Standard Contractual Clauses (SCCs), the UK IDTA, or EU-U.S. Data Privacy Framework. Flag any gaps in protection for non-EEA data transfers or lack of transparency about hosting locations.

Security and Breach Notification: Summarize the security controls mentioned, such as encryption, access management, and certifications (e.g., ISO 27001, SOC 2). Evaluate whether the DPA specifies a timeline for personal data breach notifications (e.g., 24 to 72 hours) and assess the sufficiency of the language.

Data Subject Rights (DSARs): Confirm that the processor assists with access, deletion, correction, and portability requests. Check for defined response timelines or SLAs. Note if rights support is conditional, vague, or missing.

Data Retention and Deletion: Review post-termination data handling. Confirm if data will be returned or deleted upon termination, and whether backup systems are included. Identify vague statements such as “as required by law” without details.

Audit Rights and Cooperation: Determine whether the controller is granted direct or third-party audit rights. Check if the DPA covers cooperation with DPIAs, regulatory investigations, or incident response.

Indemnity and Liability: Review whether liability is capped and if privacy-related obligations are excluded from caps. Identify any indemnities for data protection violations or third-party claims.

Regulatory Compliance: Map the DPA against GDPR Article 28 (processing instructions, confidentiality, subprocessor conditions, deletion, assistance, audit). For CPRA/CCPA, confirm the presence of “service provider” or “contractor” language, prohibition on selling or sharing data, and use restrictions. If health data is in scope, check for HIPAA-compliant terms or a Business Associate Agreement.

Emerging Risk Trends: Note whether the DPA restricts AI/ML model training on customer data, offers faster-than-required DSAR support, or provides access to audit reports or Records of Processing Activities.

Format your output as a structured privacy review report with the following sections:

Executive Summary: Include an overall risk rating (Low / Moderate / High) and a Go / Conditional Go / No-Go recommendation with a 1–2 sentence rationale.

Findings by Clause or Topic: For each key clause, summarize the issue, flag risks, highlight vague or missing terms, and quote the contract if relevant. Use concise bullet points. Label findings as sufficient, partial, or missing.

Compliance Matrix: Provide a table or list showing whether the DPA complies with GDPR, CPRA/CCPA, HIPAA (if applicable) and other data privacy laws, marked as Compliant / Partial / Gap, with short notes per law.

Suggested Redlines and Questions: Recommend draft edits or additions for key gaps. Include follow-up questions the user should raise with the vendor where language is unclear or missing.

Style guidance: Keep language concise and professional. Use clear headings and short paragraphs. If any required information is not found in the DPA, mark as “Unknown” and suggest asking the vendor.

перечень не исчерпывающий и не освобождает организации от самостоятельной оценки рисков.