How to review a data processing agreement (DPA) in Word

A data processing agreement sets the rules for how a vendor handles personal data on your client's behalf. It usually sits next to an MSA and is often presented as "standard". It still deserves a careful read, because it decides who does what when something goes wrong with the data.

Before you start: settle the roles and the law

First, confirm who is who. Under US state privacy laws the terms are often "business" and "service provider" or "controller" and "processor". Several US state privacy laws require specific terms in contracts with service providers and processors, so a DPA is often more than good practice. Next, check which laws the DPA is written for. LexDraft works under US law. If the DPA also covers GDPR or another non-US regime, review those parts against that law yourself.

Step by step: review a DPA in Word with LexDraft

1. Open the document in Word. LexDraft is a Word add-in from Microsoft AppSource. It opens as a side panel in Word 365 (Windows and Mac), Word 2021 and Word on the web, so there is nothing to upload and no other app to learn.
2. Set the job. Run the review with the DPA playbook, one of four built-in playbooks alongside NDA, SaaS MSA and Services. LexDraft also flags standard terms that are missing.
3. Read the findings by severity. Each finding is graded Critical, High, Medium or Low. Start with Critical and High, then decide how much time the rest deserve.
4. Run the quick checks. The defined-term and cross-reference checks are rule-based and run without AI. They catch terms that are used but never defined, terms defined but never used, and references such as "Section 5.3" or "Exhibit B" that point nowhere. Each finding has a jump link to the exact spot.
5. Accept or reject each redline. Proposed changes are word-level edits, so only the words that need to change are touched. When you accept one, it lands as a native Word tracked change, ready for the other side.
6. Ask about anything unclear. Use the LexDraft chat in the Word sidebar to get a plain-English explanation of a clause, then ask follow-up questions in the same chat.
7. Do your own final read. AI review can miss issues or be wrong. Qualified counsel must check every output before it goes out.

What to check in a DPA

• Scope of processing. The DPA should describe the types of personal data, the people it concerns, the purpose and the duration. Vague scope makes every other clause weaker.
• Instructions. The vendor should process data only on documented instructions, and say what happens if it believes an instruction breaks the law.
• Use limits. Look for a clear ban on selling the data or using it for the vendor's own purposes beyond the service.
• Staff confidentiality. People with access should be bound by confidentiality.
• Security measures. Check whether the measures are described or only referenced, and whether the vendor can reduce them without notice.
• Subprocessors. Is there a list? How much notice is given before a new one is added, and can your client object?
• Breach notice. Check the notice deadline, what the notice must contain, and what help the vendor gives afterwards.
• Help with requests. The vendor should help answer access, deletion and similar requests from individuals.
• Audits. Check whether your client can audit, or must accept third-party reports, and who pays.
• Return and deletion. At the end of the service, data should be returned or deleted within a stated time.
• Liability. Find out whether the MSA liability cap applies to data claims or whether there is a separate cap.
• Order of precedence. Check whether the DPA or the MSA wins if they conflict on data terms.

Common DPA review mistakes

• Reading the DPA without the MSA, then missing that the liability cap swallows the data obligations.
• Accepting "commercially reasonable" security with no detail and no right to see more.
• Ignoring the subprocessor list because it sits on a web page outside the agreement.
• Defined terms that do not match the MSA. The defined-term check flags terms used but never defined.

Where your data goes when you use LexDraft

A DPA review often makes clients ask about their own tools. LexDraft does not use customer documents to train models. Document context and model responses may be held in a short-lived service cache while you use the add-in, and expire after roughly 60 minutes of inactivity. See the security page for details.

This guide is general information, not legal advice. LexDraft does not give legal advice; qualified counsel must review every draft. Spotted something out of date? Email support@lexdraft.ai and we will fix it.