DPA essentials for SaaS teams

The MV(D)PA

Standardize the structure and push variable items into the annexes.

Must‑haves

• Roles and scope (processor vs controller)

• Subprocessor list and notice window

• Security measures mapped to ISO 27001 controls

• International transfers (SCCs Module 2)

Negotiation hotspots

• Audit rights scope and frequency

• Breach notice hours (aim for 72h with materiality)

• Deletion vs return on termination

What to skip

Duplicate warranty language from the MSA. Keep the DPA about data only.