sure-scale/doc-haus/playbook-dpa

This is an executable firm playbook for data processing agreements under the GDPR and UK GDPR, reviewed from the controller (customer) side. The contract-type and jurisdiction tags for every position below come from this header (GDPR/UK GDPR data processing agreement; EU/UK scope).

Each ## section is one clause type, stated on a fixed schema so the redline tool can paste the firm text byte-exact, the deterministic lint can detect deviation, and document-reviewer can band each clause:

• Preferred — the firm's default opening position. Text inside an

``approved fence is the firm-approved replacement text — copy it byte-exact into the redline tool's replacement` arg.

• Fallbacks — acceptable rungs below Preferred, each introduced by the

"when" condition that justifies offering it (the "offer when" trigger). Text inside an ```approved-fallback fence is the firm's fallback text, to be used only when its stated condition is met.

• Unacceptable — the walk-away floor: the position the firm does not concede

below without a human decision.

• Rationale — why the position sits where it does.

These positions are firm-configurable defaults, calibrated to be market-balanced rather than aspirational, and bounded by the Article 28 GDPR minimums (a statutory floor cannot be overridden downward). The matter's .dochaus/profile.md (see the firm-profile skill) overrides any Preferred, fallback, or above-statutory floor here; where it is silent, these defaults apply. When a counterparty term sits at or below the Unacceptable floor, do not concede: escalate to the firm's privacy / data-protection lead (or the contact named in the profile's Escalation Rules). The escalation is addressed to that role, not a named person, so the position outlasts any individual assignment.

Jurisdiction guard: This playbook applies only to processing subject to the GDPR or UK GDPR. It pairs with the EU pack and the UK packs (EW, SCT, NIR). Do not apply it to a matter with no GDPR/UK GDPR nexus, and flag to the user any DPA whose governing law or processing scope falls outside the EU/EEA and the UK. Where a position below reflects market drafting practice rather than a statutory requirement, the Rationale says so — do not present market backstops (such as fixed-hour breach-notice windows) as legal obligations.

Scope, roles, and documented instructions

Preferred: The processor processes personal data only on the controller's documented instructions, with the Article 28 GDPR mechanics for legally compelled processing and for instructions the processor believes are unlawful.

The Processor shall process Personal Data only on documented instructions from
the Controller, including with regard to transfers of Personal Data to a third
country or an international organisation, unless required to do so by
applicable law to which the Processor is subject; in such a case, the Processor
shall inform the Controller of that legal requirement before processing, unless
that law prohibits such information on important grounds of public interest.
The Agreement, this DPA, and the Controller's use of the service features
constitute the Controller's complete documented instructions at the date of
this DPA; additional instructions require the parties' written agreement. The
Processor shall immediately inform the Controller if, in its opinion, an
instruction infringes applicable data protection law.

Unacceptable: a right for the processor to process personal data for its own purposes (including product improvement or model training on identifiable data) outside the controller's instructions; instructions defined solely by the processor's privacy policy as amended from time to time; omission of the duty to inform the controller before legally compelled processing.

Rationale: Documented-instructions language tracks Article 28(3)(a) GDPR, the core of the controller-processor relationship; own-purposes processing rights make the vendor a controller in its own right, which changes the parties' regulatory exposure and must be flagged, not redlined silently.

Confidentiality of processing personnel

Preferred: Every person authorized to process the personal data is bound by confidentiality, contractually or by statute.

The Processor shall ensure that persons authorised to process the Personal Data
have committed themselves to confidentiality or are under an appropriate
statutory obligation of confidentiality, and that access to Personal Data is
limited to those personnel who need such access to perform the Processor's
obligations under the Agreement and this DPA.

Unacceptable: confidentiality limited to employees while contractors and agency staff are unaddressed; confidentiality obligations that expire on termination of employment or of the DPA.

Rationale: The commitment tracks Article 28(3)(b) GDPR; the need-to-know limitation is standard market hardening on top of the statutory floor.

Security measures

Preferred: Appropriate technical and organizational measures anchored to a specific security annex, with a commitment not to materially diminish protection during the term.

Taking into account the state of the art, the costs of implementation and the
nature, scope, context and purposes of processing, as well as the risks to the
rights and freedoms of natural persons, the Processor shall implement and
maintain appropriate technical and organisational measures to ensure a level of
security appropriate to the risk, including the specific measures described in
the security annex to this DPA. The Processor may update those measures from
time to time, provided the updates do not materially diminish the overall level
of protection for the Personal Data during the term of the Agreement.

Unacceptable: security obligations described only by reference to the processor's website policy as amended at the processor's discretion, with no non-diminishment commitment; measures qualified by "commercially reasonable" in place of the risk-appropriateness standard; no security annex or equivalent identifiable baseline at all.

Rationale: The standard tracks Article 32 GDPR; the annex anchor and the non-diminishment covenant are the market mechanics that make it enforceable (the Common Paper DPA likewise anchors security to a referenced security policy rather than leaving it free-floating).

Subprocessors

Preferred: General written authorization tied to a published subprocessor list, advance written notice of changes with an objection right, full flow-down of DPA obligations, and processor liability for subprocessor performance.

The Controller grants the Processor general written authorisation to engage the
subprocessors identified in the Processor's subprocessor list as at the date of
this DPA. The Processor shall give the Controller prior written notice of the
addition or replacement of any subprocessor at least ten (10) business days in
advance, and the Controller may object on reasonable data-protection grounds
within that period. If the parties cannot resolve an objection within thirty
(30) days, the Controller may terminate the affected services without penalty
and receive a pro-rata refund of prepaid, unused fees. The Processor shall
impose on each subprocessor, by written contract, data protection obligations
no less protective than those set out in this DPA, shall limit each
subprocessor's access to Personal Data to what is required to perform the
obligations subcontracted to it, and shall remain fully liable to the
Controller for the performance of each subprocessor's obligations.

Fallbacks: when the processor's notice mechanism is a subscription-based mailing list or feed rather than direct written notice, and the objection and flow-down mechanics are otherwise intact.

The Controller grants the Processor general written authorisation to engage the
subprocessors identified in the Processor's subprocessor list as at the date of
this DPA. The Processor shall maintain a mechanism by which the Controller can
subscribe to notice of subprocessor changes and shall publish notice of the
addition or replacement of any subprocessor at least ten (10) business days in
advance. The Controller may object on reasonable data-protection grounds within
that period, and if the parties cannot resolve the objection within thirty (30)
days, the Controller may terminate the affected services without penalty. The
Processor shall impose on each subprocessor, by written contract, data
protection obligations no less protective than those set out in this DPA and
shall remain fully liable to the Controller for the performance of each
subprocessor's obligations.

Unacceptable: unrestricted subprocessor engagement with no notice or objection mechanism; an objection right whose only outcome is that the controller continues under protest; flow-down stated as "substantially similar" obligations without the no-less-protective standard; disclaimer of processor liability for subprocessor acts and omissions.

Rationale: Notice, objection, flow-down, and retained liability are the Article 28(2) and 28(4) GDPR package; the ten-business-day notice period matches the Common Paper DPA position, and the termination-on-unresolved- objection mechanic is the market remedy that gives the objection right teeth.

Assistance with data subject requests

Preferred: The processor assists the controller with data subject rights by appropriate technical and organizational measures, routes any requests it receives to the controller, and does not respond on its own.

Taking into account the nature of the processing, the Processor shall assist
the Controller by appropriate technical and organisational measures, insofar as
this is possible, in fulfilling the Controller's obligation to respond to
requests for exercising data subjects' rights under applicable data protection
law. If the Processor receives a request from a data subject relating to
Personal Data processed under this DPA, it shall promptly notify the Controller
and shall not respond to the request except on the Controller's documented
instructions or as required by applicable law.

Unacceptable: assistance conditioned on uncapped, undisclosed fees set at the processor's discretion; a right for the processor to respond to data subjects directly without the controller's instruction; assistance limited to access requests while erasure, objection, and portability are unaddressed.

Rationale: Tracks Article 28(3)(e) GDPR. Reasonable cost-recovery for extraordinary assistance is market-acceptable, but only the controller is positioned to decide how a rights request is answered.

Personal data breach notification

Preferred: Notification without undue delay after the processor becomes aware of a personal data breach, with a 72-hour contractual backstop, required content, and ongoing cooperation.

The Processor shall notify the Controller without undue delay, and in any event
within seventy-two (72) hours, after becoming aware of a Personal Data Breach
affecting Personal Data processed under this DPA. The notification shall, to
the extent then known, describe the nature of the breach, the categories and
approximate number of data subjects and Personal Data records concerned, the
likely consequences, and the measures taken or proposed to address the breach
and mitigate its effects, and the Processor shall supplement the notification
as further information becomes available. The Processor shall provide
reasonable assistance and cooperation with the Controller's obligations to
notify supervisory authorities and data subjects. The Processor's notification
of or response to a Personal Data Breach is not an acknowledgement of fault or
liability.