Data Processing Agreement (DPA)

The first 10 questions

This is where the conversation starts. Each answer shapes what gets asked next.

1. 01What triggered this — a specific prospect's request, a procurement checklist, or getting ahead of it before you need one?
2. 02Have you already worked through a Privacy Policy for this product, or are we defining data handling here for the first time?
3. 03What categories of personal data do you process on behalf of your customers (not just your own users)?
4. 04Who are your subprocessors — cloud hosting, email delivery, analytics, support tools — anyone who touches customer data downstream?
5. 05Where is data actually stored and processed geographically, and does that matter for the customers you're selling to (EU, UK, etc.)?
6. 06What's your actual incident detection and notification capability today — how would you realistically learn about and report a breach?
7. 07Do you already comply with a specific framework (GDPR, CCPA, SOC 2) that this DPA needs to reference accurately?
8. 08Roles: confirm you're the processor and the customer is the controller (or the reverse, if applicable) for this relationship.
9. 09Subprocessor list: name each one and what they do, plus your process for notifying customers of new subprocessors.
10. 10Data location and transfer mechanism: where data lives and what safeguards apply to any cross-border transfer.

+ 6 more questions across discovery, validation, and the creative brief — each one adapting to what you've already said.

Related legal project types

• Incorporate Now — and As What?Decide whether it's time to incorporate, and what to form — LLC, C-corp, or your home-country equivalent — based on what you're actually doing, not startup folklore.
• Founder AgreementWork through equity, vesting, IP ownership, roles, and what happens if someone leaves — before those conversations become awkward or costly.
• Privacy PolicyThink through what data you collect, how you use it, and who you share it with — and produce a privacy policy tailored to your product, not a generic paste job.