Vendor DPA finder

A typical result

Search for a product or its parent company. A match gives you the legal entity, an agreement link where recorded, and the library review date.

What to check

Confirm the exact service, plan, region and contracting entity. A link in this directory is not evidence that you accepted an agreement.

A link here points at terms the vendor publishes. Five things it does not tell you, and each has caught somebody out:

• Which entity you contract with. Many vendors have a US parent and an Irish or UK subsidiary, and which one appears on your invoice decides whether a transfer happens at all. Check the invoice, not the website.
• Whether it applies to your plan. Some vendors publish a data processing agreement that only takes effect on business or enterprise plans, or only once you accept it in the product.
• Whether you have accepted it. A published document is an offer. Some vendors require a signature or an in-product acceptance, and until then you have no agreement to point a customer at.
• Which transfer mechanism covers you. UK and EU transfers can rest on different instruments, and a vendor that lists EU standard contractual clauses may not mention the UK addendum you also need.
• Whether it is current. Vendors update their terms without telling customers. The review date beside each entry is when the library last read the page, not when the vendor last changed it.

None of this is a judgement about a vendor. It is the difference between a link you found and a fact you can put in front of a customer who asks.

ICO guidance: controllers, processors and contracts. Guidance checked 7 September 2026; the ICO marks it as under review following the Data (Use and Access) Act.

These tools help you prepare a draft. Review the facts and the customer's requirements before sharing it.