A Data Processing Agreement Review That Caught a Real Problem

I'll admit I usually treat DPA review as a checkbox — skim for the obvious red flags, confirm standard contractual clauses are present, move on. A client asked me to review the DPA for a new analytics vendor before they signed, and this one actually mattered.

Buried in the subprocessor list, three levels deep in a linked exhibit, was a data enrichment vendor the analytics tool used to append firmographic data to visitor records. That enrichment vendor wasn't disclosed anywhere in the analytics tool's own marketing materials or sales conversation — it only showed up because I actually opened the exhibit instead of trusting the summary page.

Why this specific detail mattered

My client's own customer contracts contractually prohibited sharing visitor data with any third party for enrichment purposes without explicit written consent — a clause their legal team had negotiated specifically for a healthcare-adjacent client base. Signing the analytics vendor's DPA as-is would have put them in breach of their own customer agreements the moment that enrichment vendor touched a single visitor record.

The DPA you're reviewing is never just about the vendor in front of you. It's about every subprocessor hiding in their exhibits, and every contract you've already signed that constrains what those subprocessors are allowed to do.

What changed in how we review these now

• Every subprocessor list gets cross-checked against the client's own downstream contractual obligations, not just against general privacy law
• Linked exhibits get opened and read, not assumed to match the summary
• Enrichment and data-append features get flagged specifically, since they're the most common hidden subprocessor pattern we see
• Any DPA review now produces a one-page plain-language summary for the client's own commercial team, since the people who'd actually be in breach rarely read the DPA themselves

The vendor ended up fine — they amended the subprocessor disclosure and added a consent gate on the enrichment feature once we flagged it. But the deal almost closed without anyone catching it, and the only reason it didn't was that someone actually read exhibit C instead of trusting that DPAs are interchangeable boilerplate.