Data Processing Agreement Extractor

The document number and date, the effective and expiration dates, the data controller name and address, the data processor name and address, the processing purpose, the data categories and data subject categories (arrays), the processing location, and the data retention period.

A DPA (Data Processing Agreement) is the GDPR Article 28 contract between a data controller and a data processor: it sets the processing scope, the sub-processor rules, the technical and organizational measures, and the international transfer mechanism. A DPIA (Data Protection Impact Assessment) is an internal risk study of a processing activity, not a contract between two parties. For the assessment use the DPIA extractor.

A sub-processors table returns each processor id, name, address, processing activities, and approval date; a security measures table returns each measure id, type, description, and implementation status; a processing activities table returns each activity with its data categories and duration; and a data categories table returns each category name, description, and sensitivity level.

The international transfer mechanism (enum, such as Standard Contractual Clauses, Binding Corporate Rules, or adequacy decision), the SCC version, the supplementary measures (array), the data subject rights (array), the audit rights (boolean), whether sub-processors are approved and whether notification is required, and the data protection officer contact each come back as fields.

PDF only, up to 10MB and 100 pages. The agreement is processed via the Talonic API for extraction only, is not retained for training, and is not shared.