Every enterprise customer sends a Data Processing Agreement. Most are 10 to 20 pages of dense legal text. Most founders sign them without reading.

That is a mistake. Not because every clause matters. Because five of them determine your actual risk exposure.

What a DPA is

A Data Processing Agreement governs how you handle customer data. If you process personal data on behalf of a customer (which most SaaS companies do), GDPR and other privacy frameworks require a DPA.

The DPA defines your obligations as a data processor. It specifies what you can do with the data, how you must protect it, and what happens when something goes wrong.

The five clauses that matter

1. Liability cap

Is data breach liability capped or uncapped?

Some DPAs cap liability at the contract value or 12 months of fees. Others leave data breach liability uncapped. An uncapped DPA on a $50,000 annual contract exposes you to millions in potential liability.

What to negotiate: Cap data breach liability at a multiple of annual fees (2x to 3x is common). If the customer insists on uncapped liability, that is a commercial decision, not a legal default.

2. Subprocessor approval

Must you get explicit customer consent before adding a new subprocessor? Or can you simply notify them?

Consent-based approval gives customers a veto over your tooling decisions. If you need to add a new analytics or infrastructure provider, you must wait for approval from every customer whose DPA requires it.

Notification-based approval lets you add subprocessors and notify customers, who can object within a set window.

What to negotiate: Notification with a reasonable objection period (30 days is standard). Consent-based approval creates operational bottlenecks at scale.

3. Breach notification timeline

24 hours? 48 hours? 72 hours? "Without undue delay"?

The notification window determines your incident response obligations. A 24-hour window means you need a breach response process that can identify, assess, and notify within a single day.

What to negotiate: 72 hours is the GDPR standard. Match your DPA commitment to your actual incident response capability. Do not agree to 24 hours if your team cannot deliver it.

4. Data deletion and return

What happens to customer data when the contract ends?

Some DPAs require deletion within 30 days. Others require 7 days. Some require certification of deletion. The timeline and method determine your post-termination obligations.

What to negotiate: A reasonable deletion window (30 days is standard) with an option for the customer to export data before deletion. Avoid commitments shorter than your actual data retention architecture supports.

5. Audit rights

Can the customer audit your data processing practices? How?

Some DPAs grant unlimited on-site audit rights. For a startup, hosting customer auditors on-site is operationally disruptive. Others accept third-party certifications (SOC 2, ISO 27001) as a substitute.

What to negotiate: Accept audit rights but limit to once per year with reasonable notice. Offer SOC 2 reports as the primary compliance evidence. Reserve on-site audits for situations where a report is insufficient.

The bottom line

A DPA is not a document you sign and forget. These five clauses determine your liability exposure, operational flexibility, and incident response obligations for the life of the contract.

Read the DPA before you sign it. Negotiate the clauses that matter. Accept the ones that do not.

If your SaaS contracts need the same attention, here is how to offboard customers without burning bridges, and our SaaS lawyer page covers how we work with product teams.

We help founders review and negotiate DPAs that protect the company without killing deals. If you have a stack of unsigned DPAs or a customer pushing aggressive terms, reach out at Fellow.