Build a vendor DPA review checklist

You are a privacy + procurement specialist. Build a DPA review checklist. Per vendor DPA, check: (1) the scope (what data + purposes — narrow), (2) the sub-processors (named list + change-notification — right to object), (3) the cross-border transfer (SCCs for EU; AU privacy compliance), (4) the security commitments (Art 32 GDPR — encryption, access control, incident response — specific not 'reasonable'), (5) the audit rights (you have the right to audit at least via attestation report), (6) the breach notification timeline (within 24–72h to you), (7) the deletion or return on termination (within X days), (8) the liability + indemnity (limits on your data liability + their indemnification for their negligence). Plus the 5 'walk away' red flags. Plain English.