How to review a data processing addendum before sending it to counsel

Freeze the customer request and its agreement set

Start by naming the DPA, main agreement, order form, security addendum, referenced policies, and any questionnaire or exhibit the customer expects the team to review. Record the version, sender, received date, requested response date, and internal owner for each file. Preserve the originals instead of replacing them with a combined summary.

Add a short commercial brief that explains the customer relationship, product being purchased, intended launch, systems in scope, and the person authorized to approve a business exception. Label that brief as context. It can orient the review, but it should not be confused with contract language or technical evidence.

• Name the exact DPA and main-agreement versions under review.
• Inventory every document incorporated or linked by the addendum.
• Record the customer owner, technical owner, and requested deadline.
• Keep sales expectations separate from source-backed commitments.

Draw the data flow the team can actually verify

Create a plain-language map of the customer information the product is expected to receive, where it enters, which systems handle it, which providers support the service, where operational copies or backups may exist, and what happens when the relationship ends. Ask the people who run those systems to verify the map rather than relying on a stale diagram or sales description.

Keep unknowns visible. If the team cannot confirm a provider, storage location, access path, retention behavior, or deletion step, leave it open and assign an owner. The map is an internal fact record for the review; it is not a conclusion about the addendum or the law.

• Separate customer assumptions from confirmed product behavior.
• Name the system or provider behind each processing step.
• Record who verified each material fact and when.
• Do not fill an evidence gap with a confident summary.

Pair each requested commitment with evidence

Read the addendum for the subjects the team will need to administer, such as defined data, processing instructions, security commitments, provider references, incident workflows, assistance requests, audit materials, return or deletion steps, and the effect of termination. Capture short excerpts and exact source locations instead of paraphrasing them into a promise.

Beside each excerpt, link the available business evidence: the verified data-flow note, an approved policy, a provider record, a current process owner, or an open question. Evidence can show what the company does today. Counsel can determine how that record relates to the proposed language and what drafting or decision is needed.

• Keep the DPA passage beside the related main-agreement language.
• Identify the evidence owner and the date it was checked.
• Mark a requested commitment that the team cannot yet verify.
• Do not convert a technical control description into a legal conclusion.

Route the open items by decision owner

Classify each open item by the person best placed to move it forward. Product and engineering can confirm system behavior. Security can verify approved control evidence. Operations can confirm response and deletion workflows. Sales or leadership can own commercial choices. Counsel can address interpretation, drafting, and legal risk.

Some items will cross lanes, but the packet should still name the next action. A question such as whether the company can support a proposed response window should travel with the source passage, current process evidence, the operational owner, and the specific judgment counsel is being asked to provide.

• Technical: which product or provider fact needs confirmation?
• Evidence: which current record supports the team's statement?
• Commercial: who can approve an operating commitment or exception?
• Legal: what interpretation or drafting question remains for counsel?

Send counsel one evidence-backed DPA packet

The handoff should include the frozen agreement inventory, commercial brief, verified data-flow map, source-linked commitment table, supporting evidence list, open gaps, decision owners, and prioritized questions. Keep outdated policies and superseded drafts available but clearly separated from the materials counsel is being asked to review.

For each uploaded contract document, CounselOS can preserve source-linked clause extracts, surface playbook deviations, capture questions beside the relevant finding, and export selected material in a review packet. The data-flow and control-evidence map remains a human-reviewed operating record; CounselOS keeps the contract evidence traceable for the business and attorney making the next decisions.