The 9 mandatory elements of GDPR Art. 28
A controller-to-processor DPA must specify (per Art. 28(3)): (1) subject matter and duration of processing; (2) nature and purpose of processing; (3) type of personal data; (4) categories of data subjects; (5) obligations and rights of the controller; (6) processor instructions only on documented instructions; (7) confidentiality; (8) security measures; (9) sub-processors with controller authorization. Our generator captures each element in a dedicated section.
Why the SCCs matter (Module 2 specifically)
Post-Schrems II, transfers of EU personal data outside the EEA require a transfer mechanism. The European Commission published modular Standard Contractual Clauses in 2021. Module 2 covers controller-to-processor (the SaaS vendor case). Our generator references the SCCs by their decision number 2021/914 and incorporates Module 2 for international transfers — including a flag for Schrems II supplementary measures (encryption + access controls beyond standard).
Sub-processor disclosure expectations
Enterprise EU customers will expect a list of sub-processors (AWS, Stripe, Anthropic, etc.) with their data location + DPA URL. Our generator captures this as a free-text field that flows into the DPA. The list should be maintained as a customer-facing page (we recommend hosting it via DG-401 at /hosted/[customer]/sub-processors).