GDPR Article 28 DPA checklist: check the mandatory clauses
GDPR Article 28(3) lists what a contract between a controller and a processor must contain. Legal teams and DPOs check it for every new vendor, law firms in client contract reviews, and SaaS vendors whose customers send their own templates.
Up to 20 pages a month free. Files are not stored.
Legal source
Regulation (EU) 2016/679 (GDPR), Article 28(3)Law as of
2018-05-25
Unchanged since 25 May 2018.
Our measurement
Precision 96–100%, recall 92–100% (2 blind rounds, 7 agreements)
What we check (13 provisions)
Subject-matter and duration
art. 28 ust. 3 zd. 1
Nature and purpose of processing
art. 28 ust. 3 zd. 1
Types of personal data
art. 28 ust. 3 zd. 1
Categories of data subjects
art. 28 ust. 3 zd. 1
Processing only on documented instructions (incl. transfers)
art. 28 ust. 3 lit. a
Confidentiality of authorised persons
art. 28 ust. 3 lit. b
Security measures (Art. 32)
art. 28 ust. 3 lit. c
Sub-processors: authorisation and same obligations
art. 28 ust. 3 lit. d, ust. 2 i 4
Assistance with data subject rights
art. 28 ust. 3 lit. e
Assistance with Arts. 32–36 (security, breaches, DPIA)
art. 28 ust. 3 lit. f
Deletion or return of data at the end
art. 28 ust. 3 lit. g
Information and audits / inspections
art. 28 ust. 3 lit. h
Informing about an infringing instruction
art. 28 ust. 3 akapit drugi
What the result looks like
For each provision you get "found" with a verbatim quote and the file name, or "not found in the documents". The quote is cut from the document character for character, so you can verify it in the original in seconds.
The engine is deterministic: no generative model, the same document always gives the same result. It does not judge whether a provision is adequate; that is the lawyer's call.
Frequently asked questions
What must a data processing agreement contain?
Under Regulation (EU) 2016/679 (GDPR), Article 28(3): subject-matter and duration; nature and purpose of processing; types of personal data; categories of data subjects; processing only on documented instructions (incl. transfers); confidentiality of authorised persons; security measures (Art. 32); sub-processors: authorisation and same obligations; assistance with data subject rights; assistance with Arts. 32–36 (security, breaches, DPIA); deletion or return of data at the end; information and audits / inspections; informing about an infringing instruction. KROTKA checks each of these provisions separately.
Does KROTKA use AI to check the contract?
Not generative AI. The list runs on deterministic rules: the same document always gives the same result, and every provision found is shown as a verbatim quote you can verify. The engine does not invent or paraphrase anything.
Which version of the law do you compare with?
The law as of 25 May 2018. Unchanged since 25 May 2018.
How accurate is the list?
Our measurement: Precision 96–100%, recall 92–100% (2 blind rounds, 7 agreements). We measure on agreements the engine has not seen before, against independently prepared annotations.
Does KROTKA judge whether a clause is adequate?
No. It shows whether and where the provision appears. Judging its content is the lawyer's job. "Not found" means the engine found no such provision in the uploaded documents. KROTKA does not provide legal advice.
Can the DPA be part of the terms of service?
Yes. The GDPR requires a contract or other legal act in writing, including electronic form. The list checks the content whether the clauses sit in a separate document or in the terms: upload all documents together.
Are my documents stored?
No. Files are analysed in memory and not stored on our servers. They are never used to train models.
How much does a check cost?
Up to 20 pages a month free. A single matter up to 150 pages is €24, the Professional plan €59 a month for 2,000 pages. Every list runs on every analysis.
Other checklists
- DORA Art. 30: ICT third-party contract
- UK Construction Act (HGCRA 1996): payment and adjudication
- HIPAA: business associate agreement (BAA)
- UK Employment Rights Act s.1: written statement of particulars
- Polish Public Procurement Law: mandatory contract terms
Up to 20 pages a month free. Files are not stored.