Show that every processor's DPA covers Article 28(3)
Your AI fetches each vendor's DPA and quotes the clauses. ISMS Copilot says whether they cover Article 28(3) and where the gaps are. You file the evidence.
The finding that says "no executed DPA"
A common audit finding on suppliers is a list of processors without an executed DPA. Often the DPA exists: large providers bind you through the terms you accepted, and some contracts were signed and never filed. Other vendors are not processors of your data at all. Sorting this out means reading each vendor's DPA, finding the clause for each Article 28(3) element, and keeping a dated copy. Your AI does the reading and the quoting. ISMS Copilot judges coverage: does this clause meet the element, does accepting the terms bind the vendor, is this vendor a processor at all.
Explore the GDPR Copilot →How the work splits
- 01
Your AI collects the clauses
For each vendor it fetches the current DPA, saves a dated copy, and quotes the clause for each Article 28(3) element, or notes that there is none.
- 02
ISMS Copilot judges coverage
It says whether each quoted clause covers its element, whether the vendor is a direct processor, and what a gap means for you.
- 03
You decide and file
You file the evidence, accept a residual risk or ask the vendor. Any message to a vendor is yours to send.
Receipt: a real run, 12 October 2026
- Input
- Nine vendors that an internal audit listed as processors without an executed DPA
- Your AI's part
- Fetched each vendor's current DPA (hosting, storage, logging and source-control vendors such as Backblaze and GitHub), saved dated copies, quoted the clause for each Article 28(3) element
- ISMS Copilot's part
- 6 bound by accepting the provider's terms. 3 not direct processors of this data.
- Gaps found
- 2: one DPA promises deletion only, with no option to get the data back first (Art. 28(3)(g)); one has no clause on helping with a DPIA (Art. 28(3)(f))
- Also found
- A DPA signed with another provider that had never been filed
Frequently Asked Questions
Does accepting a vendor's terms count as an executed DPA?
It can, when the provider's terms include the DPA and you accepted them. That is a judgment per vendor, which ISMS Copilot gives you with the clause quoted. Keep a dated copy of what you accepted as the evidence.
Does ISMS Copilot fetch the DPAs?
No. Your AI fetches them with its own web access and sends the quoted clauses, which also keeps each judgment tied to the text.
Will anyone contact the vendor?
Not without you. If a gap needs an answer from the vendor, you send the message.
Turn "no executed DPA" into evidence
Your AI quotes the clauses, ISMS Copilot judges Article 28(3), you file the result.