Overview
This check reconciles the live Tag Inventory observed on the site against your internal Legal Vendor Register, isolating any script executing in your digital environment that isn't mapped to a vendor with an active, verified Data Processing Agreement containing appropriate contractual safeguards (including Standard Contractual Clauses where the vendor processes data outside the EEA).
Note: This guide is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your organization's specific GDPR compliance obligations.
Why it is important
Under Article 28, you are directly responsible for the vendors executing code inside your digital boundaries; a script that runs without a corresponding, verified DPA represents a processor relationship you cannot demonstrate you've properly authorized, independent of whether the vendor is otherwise reputable or the data it collects is otherwise appropriate. This is the vendor-level counterpart to the cross-border transfer check: a valid DPA with SCCs covers the contractual relationship, while the geolocation check separately confirms the actual data routing matches what the DPA describes.
Implementation
Create an Audit and run it to collect a full Tag Inventory.
Check the pre-built ObservePoint report for Vendor and Tag Inventory for DPA Reconciliation.
Cross-reference the vendors in the report above against your internal Legal Vendor Register and isolate anything unmapped or whose DPA has lapsed.
Remediation
For remediation, check the following steps:
For any tag with no matching vendor register entry, determine the receiving party and work with procurement/legal to establish an appropriate DPA, including Standard Contractual Clauses if the vendor processes data outside the EEA, before continuing to allow the tag to execute; consider temporarily disabling a newly discovered, unvetted high-risk tag while the DPA is finalized rather than allowing an unauthorized processing relationship to continue indefinitely.
For a tag whose vendor DPA has lapsed or expired, treat it with the same urgency as a missing DPA, since an expired agreement provides no more legal coverage than none at all.
Update the Legal Vendor Register and re-run the Tag Inventory reconciliation once each classification and agreement is finalized, and confirm the specific tag/domain mapping in the register accurately reflects what's actually executing on the live site rather than a general vendor name.
Conclusion
This reconciliation is what turns your Vendor Register from a static legal document into a living, continuously verified control — pairing it with the quarterly full-crawl cadence keeps new, unvetted processor relationships from accumulating undetected between reviews.