This page lists three turns, the messages you send to the AI one after another in the same chat, and then a check of the answer. Keep it open next to your chat. Each turn shows the next thing to paste, with the values you entered already filled in. Nothing is sent from this page, and your conversation stays in the AI tool you are using.
Paste the full DPA and every annex, schedule, and incorporated transfer document.
Categories, volume, sensitivity, data subject locations, and what the vendor does with the data.
Flips every position: a controller wants control and audit, a processor wants workable operational commitments.
Which privacy laws reach this processing, which supervisory authority is likely lead, and what law governs the DPA.
Who the vendor is, where they operate, and which sub-processors and countries you already know about.
Watch for these throughout
Standard contractual clauses, UK transfer instruments, and adequacy decisions change. Confirm which version and which module the DPA actually incorporates against the current official text before you rely on any conclusion here.
Remote access from a third country is a transfer even when the data never leaves the region. Support and engineering rotas are where this is missed.
Sub-processor lists go stale within a quarter. Require notice of changes and a right to object, not a static annex.
Technical measures described as "industry standard" or "commercially reasonable" commit the vendor to nothing. Insist on named controls: encryption standard, key management, MFA, retention, logging.
A DPA that gives you less than you have promised your own customers creates a gap you cannot close later. Compare the two before signature, not at renewal.