For licensed Collaborators with permission for this task. Check the selected organisation; feature availability and record access still apply.
What you will achieve
Connect supplier agreement evidence to the processing it supports and identify gaps that need an owner's review.
Before you start
Open the correct supplier relationship and confirm permission to maintain its contracts and asset links. Have the actual agreement, its term and the relevant processing scope available.
This guide explains recording and inspecting evidence in Backstory. It does not determine whether an agreement is legally adequate; involve the responsible privacy or legal reviewer for that judgement.
Review the DPA position
- Open the supplier relationship's Compliance > DPA page.
- Read DPA contract evidence. Check which data-processing contracts are recorded and whether their dates match the agreement you rely on.
- Inspect the displayed safeguards, including audit rights, breach notice, data return and transfer information. A captured value is evidence of a recorded field, not proof that the contractual protection is sufficient.
- Review Processing scope by asset. Identify the assets for which the supplier processes personal data, their recorded role and categories, DPA evidence and review date.
- Read International transfer safeguards for relevant asset links. Treat missing mechanisms or supporting detail as follow-up work, not automatic approval or a legal conclusion.
Record or correct the sources
Use Manage contracts to open the supplier's contract register. Create or update the appropriate data-processing contract with its actual term and available safeguard evidence. Link the relevant RoPA records where supported and appropriate.
Use Manage asset links to check the supplier-to-asset relationship. Record the processing role, categories, location and DPA status from evidence. Set a review date that reflects your organisation's review arrangement.
Return to the DPA page after saving. Its summary is derived from these source records; do not look for a single switch that declares the whole supplier compliant.
Check it worked
The correct contracts and personal-data asset links appear, with accurate dates and supporting details. Any remaining evidence gaps have an owner and a next action. Verify that agreement scope actually corresponds to the processing recorded.
If something goes wrong
| Problem | Next action |
|---|---|
| No DPA contract is shown | Check the contract's type and supplier association |
| A personal-data asset is missing | Review the underlying supplier-to-asset link and processing fields |
| Review date is overdue | Arrange the review; do not change the date merely to clear the warning |
| A transfer safeguard is unclear | Refer the source agreement and processing facts to the authorised reviewer |
Human judgement matters
A green evidence indicator means something was captured. It does not replace review of the agreement, processing reality or applicable obligations.
What next?
For the wider context, see Manage suppliers, contracts, spend and SLAs. Link the follow-up work and revisit this page when the contract or processing scope changes.
Get help
Ask your Organisation Administrator about access or the task owner about the content. For a platform error, include this guide reference, the affected page and a sanitised message. Never share passwords, session details or confidential evidence in an open support request.