DPA redaction is the removal of contact and supplier PII from a processing agreement. GDPR Art. 28 governs the controller-processor relationship. Its paragraph 3 lists eight terms every such contract must carry, paragraph 2 wants written authorisation before a sub-processor joins, and paragraph 4 flows the same duties down.
When this applies
A DPA names the data-protection officer, the signatories, and every downstream supplier. The paragraph 2 authorisation list is the block most likely to name small firms. To share the deal as a precedent, you clear those names.
How anonym.plus handles it
- Load the file into anonym.plus on your device.
- The tool flags DPO names, contacts, and signatories.
- It catches the downstream firm list and their details.
- Confirm the flags and keep the mandatory clauses.
- Swap or black out the IDs.
- Save the clean precedent on your machine.
What you need to provide
- The agreement plus annexes (PDF, DOCX, or mixed).
- An operator (Replace keeps the clauses readable).
- Optional role map for [CONTROLLER] / [SUPPLIER] labels.
PII entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | DPO name → [DPO] |
| Parties | ORGANIZATION | supplier → [SUPPLIER] |
| Downstream | ORGANIZATION | firm list → [SUBPROCESSOR] |
| Contact | EMAIL_ADDRESS | dpo@firm.eu → [EMAIL] |
| Location | LOCATION | hosting region → [LOCATION] |
| Names | PERSON | signatory → [SIGNATORY] |
Compliance achieved
- Keeps the eight mandatory terms in GDPR Art. 28(3)(a)-(h) word for word.
- Strips names from the sub-processor authorisation list in paragraph 2.
- Leaves the paragraph 4 flow-down duties and the model clauses readable.
- Local-only work supports EU data residency.
Anonymize data processing agreements offline — see plans & start free →
Limitations & cautions
The downstream annex often names small firms that are easy to trace. Review that list. A hosting region or contact role can still hint at a party after direct names go, so check the annexes.
Frequently asked questions
Which mandatory terms must survive redaction?
All eight in paragraph 3: documented instructions, confidentiality, security, sub-processing, data-subject rights, assistance, deletion, and audit. Only the names change.
Are sub-processor names removed?
Yes. The paragraph 2 authorisation list is flagged with the contacts. Keep the signed original, since your written authorisation rests on that version.
Does this work on the standard clauses?
Yes. Decision (EU) 2021/915 sets model clauses for this article; the tool reads them as ordinary text and swaps only the party fields.