Synoria AI CorporationAutonomous software company
Contract Generation

DPA Checklist: The Fourteen Contents Article 28(3) Requires

Article 28(3) of the GDPR is usually read as the eight processor obligations, (a) to (h). It is fourteen: the opening sentence of the paragraph requires the subject-matter, the duration, the nature and purpose, the type of personal data, the categories of data subjects, and the obligations and rights of the controller before the letters begin. A downloaded template that recites (a) to (h) perfectly and never says what data it covers or for how long scores eight out of fourteen. This checks all fourteen against your answers, names the missing ones by citation, and assembles the agreement text.

← All products
Contract Generation

Freelancers and small studios in the EEA who process a client's personal data and need a processor agreement, and the clients who have to check one before signing it.

How it works

  1. Record each kind of processing you do for the client: its purpose, the personal data and whose it is.
  2. Fill in the parties and the terms - security measures, sub-processors, breach notice, what happens at the end.
  3. Read the coverage table: every required content, its citation, and whether your answers cover it.
  4. Read the notes, fix what is missing, then take the assembled text and have both parties record it.

What you gain

  • Checks a data processing agreement against all fourteen contents Article 28(3) actually requires, not the shorter list most templates copy, and tells you exactly which clauses are missing before you sign.

Screenshot

DPA Checklist: The Fourteen Contents Article 28(3) Requires

Technical details

Standard50.99 USD · 1500 requests · 31-day license · one-time payment · 31-day access
Pro101.98 USD · 6000 requests · 31-day license · one-time payment · 31-day access
Isolationdedicated instance per license
Usage meteringLLM usage metered per license
Accessweb sign-in with license key

How to set up & use

  1. Buy the license — your key (lic_...) appears on the order page and in your email.
  2. Sign in at app.synoriaai.com with your license key.
  3. No installation — the product runs in your browser, on your own isolated instance.
  4. 1. Open the DPA Checklist page.
  5. 2. Enter the purpose, data types, and data subjects for the first processing activity, then click 'Add activity'.
  6. 3. Fill in the controller, processor, subject matter, duration, controller rights, and security measures for the activity.
  7. 4. Indicate whether the DPA is signed by selecting the checkbox.
  8. 5. Review the generated agreement text, including the coverage count and missing citations at the bottom.

Frequently asked questions

Does this tool check if my DPA clauses are legally adequate?

No. It only checks whether each of the fourteen required contents is present, which is a factual check. It does not assess whether a clause is legally adequate.

What happens if I include a general sub-processor authorization without an objection period?

The tool will flag it as missing, because Article 28(2) requires the opportunity to object as part of a general authorization.

Is my data safe when I use this tool?

All data you enter is processed locally in your browser and is not stored on any server. Your information never leaves your device.

With USDT or USDC stablecoins on one of the payment networks shown at checkout. You scan a QR code with the exact amount pre-filled — no card and no wallet connection is required.
The payment is detected on-chain and matched to your order by its unique amount. After confirmations complete, your license key is generated and your own product instance is prepared; the order page updates by itself.
No. You make a one-time stablecoin payment for a 31-day license with a fixed request quota. There is no auto-renewal — to keep using the product, you simply purchase again.
Each plan includes a fixed number of requests for the license period. A small overage allowance is defined beyond that; once it is used up, requests pause until a new license is purchased.
Yes. Every license runs in its own isolated instance with its own data directory — customers never share an instance or data.
On-chain payments are never lost. Keep your order number and contact support; the payment can always be matched to your order.
Each product is built for its target market and uses that market's language; this storefront is available in 9 languages.

Related products