Vendor MSA v3 and DPA v2 Review: Blocked, No Document Text or Playbook Supplied
Interpretation (stated once): The request asks for a customer-side, EU-jurisdiction review of "Vendor MSA draft v3 (pasted text)" and "Data Processing Addendum v2.pdf" against "our contracting playbook (pasted)" and GDPR Article 28, with high-risk redlines only. This workspace held no pasted MSA text, no DPA PDF and no playbook: no input_files/ or references/ folder existed, only an unrelated helper script. No document was reviewed, so no finding, status, clause location or redline is given. Inventing clauses would break the "never guess" rule. What can be delivered is the verified GDPR Article 28 checklist, which is ready to apply once the files are supplied.
Summary table
| Document | Requirements checked | Meets | Partial | Missing | Conflicts | High-risk items |
|---|---|---|---|---|---|---|
| Vendor MSA draft v3 | 0 of 22 GDPR rows; playbook rows unknown | unchecked | unchecked | unchecked | unchecked | unchecked (text not supplied) |
| Data Processing Addendum v2.pdf | 0 of 22 GDPR rows; playbook rows unknown | unchecked | unchecked | unchecked | unchecked | unchecked (file not supplied) |
Rows filtered out by the high-risk-only emphasis: none, because no rows were produced.
Rule source: GDPR Article 28 checklist (verified)
Source: Regulation (EU) 2016/679, EUR-Lex consolidated HTML, accessed 2026-10-05. The wording below is paraphrased from the fetched Article 28 text. I did not check whether later amendments or national implementations differ. Each row is one testable obligation. "Expected home" is my inference about where such terms usually sit (an MSA or a DPA), not a finding.
| # | Requirement | Art. 28 cite | Document location | Status |
|---|---|---|---|---|
| 1 | Controller uses only processors giving sufficient guarantees on technical and organisational measures | 28(1) | not found | unchecked |
| 2 | Contract is binding on the processor and sets out subject-matter and duration | 28(3) | not found | unchecked |
| 3 | Contract sets out nature and purpose of processing | 28(3) | not found | unchecked |
| 4 | Contract sets out type of personal data and categories of data subjects (HR data: employees, applicants, dependants?) | 28(3) | not found | unchecked |
| 5 | Contract sets out controller's obligations and rights | 28(3) | not found | unchecked |
| 6 | Processing only on documented instructions, including on third-country transfers, unless Union or Member State law requires otherwise | 28(3)(a) | not found | unchecked |
| 7 | Processor informs controller of that legal requirement before processing, unless the law prohibits it | 28(3)(a) | not found | unchecked |
| 8 | Persons authorised to process are bound by confidentiality | 28(3)(b) | not found | unchecked |
| 9 | Processor takes all Article 32 security measures | 28(3)(c) | not found | unchecked |
| 10 | Sub-processor engagement needs prior specific or general written authorisation | 28(2) | not found | unchecked |
| 11 | Under general authorisation, processor notifies intended changes and allows the controller to object | 28(2) | not found | unchecked |
| 12 | Processor respects the sub-processor conditions in 28(2) and 28(4) | 28(3)(d) | not found | unchecked |
| 13 | Same data protection obligations flow down to sub-processors by contract | 28(4) | not found | unchecked |
| 14 | Initial processor stays fully liable to the controller for sub-processor failures | 28(4) | not found | unchecked |
| 15 | Assistance with data-subject rights requests (Chapter III) | 28(3)(e) | not found | unchecked |
| 16 | Assistance with Articles 32 to 36 (security, breach notification, DPIA, prior consultation) | 28(3)(f) | not found | unchecked |
| 17 | Breach notice to controller "without undue delay" after awareness | Art. 33(2), reached via 28(3)(f) | not found | unchecked |
| 18 | At controller's choice, delete or return all personal data after services end, and delete copies unless law requires storage | 28(3)(g) | not found | unchecked |
| 19 | Provide all information needed to show compliance | 28(3)(h) | not found | unchecked |
| 20 | Allow and contribute to audits and inspections by the controller or its mandated auditor | 28(3)(h) | not found | unchecked |
| 21 | Processor immediately informs controller if an instruction infringes data protection law | 28(3), final subparagraph | not found | unchecked |
| 22 | Contract is in writing, including electronic form | 28(9) | not found | unchecked |
Article 28(10) is context rather than a contract term: a processor that determines purposes and means is treated as a controller for that processing. Article 28(5) to (8) cover codes of conduct, certification and standard contractual clauses and are optional routes, not obligations.
Top risks
- Nothing could be assessed. The practical exposure is that rows 6, 10 to 14, 18 and 20 are where vendor-paper MSAs and DPAs most often fall short. This is my general expectation, not a finding about these documents.
- Playbook requirements (liability caps, governing law, SLA, termination and so on) cannot be listed because the playbook text was not provided.
Not applicable
- Article 28(5) to (8): optional mechanisms, not mandatory contract terms.
- Article 28(10): a consequence rule, not a drafting requirement.
Do next
- Paste the full MSA v3 text, or attach it as a file.
- Attach
Data Processing Addendum v2.pdfas a file; a PDF may need to be text-extractable. - Paste the playbook with its section numbers so each rule can be cited.
- Confirm whether the SaaS vendor's data-hosting location and sub-processors are outside the EEA. That would add transfer rules beyond the named rule set.
- Re-run for the requested high-risk redlines. Redline text must be drafted in the documents' own defined terms, which are not available now.
Open items
- Which version of the playbook applies, and does it set stricter terms than Article 28, for example a breach-notice deadline in hours?
- Is HR data special-category data (health, union membership)? That affects risk ratings. The Article 9 rules are outside the named rule set and are noted here once as a related rule.
- Is a qualified EU data-protection lawyer reviewing the final redlines? This output is not legal advice.
Coverage
Unreached: Vendor MSA draft v3 (no pasted text received), Data Processing Addendum v2.pdf (no file received), contracting playbook (no pasted text received). Reached: GDPR Article 28 and Article 33(2) text.