The scope problem
Most organisations underestimate vendor scope by 3-5x. The 'official' vendor list maintained by procurement covers maybe a third of the actual processors. The rest are tools onboarded by individual teams, point integrations bought without procurement, free tiers of SaaS used by departments, contractor-introduced sub-vendors.
A typical mid-sized B2C company has 80-150 processors when fully inventoried. A typical B2B SaaS company has 30-80. Both will count 20-30 in their 'official' list at the start of the exercise.
The sequencing
You cannot remediate everything at once. The right sequencing for a 12-month programme:
Months 1-2: Discovery
Survey every team. Audit network egress, OAuth apps, expense reports for SaaS subscriptions, payment-aggregator transaction lists. The output: a complete vendor inventory.
Months 2-4: Triage
Categorise vendors by risk (data sensitivity × volume × criticality). Top tier: 10-20 vendors holding the largest, most sensitive data sets. These get the deep DPA, full security review, and on-site audits if material.
Months 3-9: Top-tier remediation
Update DPAs with top-tier vendors. Vendor DDQ (Template 08) for each. Document sub-processor flow-down, breach attribution, indemnity. Average cycle time per top-tier vendor: 4-8 weeks of legal-and-procurement back-and-forth.
Months 6-12: Mid-tier
Standard DPA addendum to mid-tier vendors. Lighter DDQ. Done in batches of 5-10 at a time.
Months 9-12: Long tail
For low-tier vendors (low data sensitivity, low volume), a simpler approach: a one-page DPDP attestation, a clickwrap DPA, or a contract clause referencing your standard terms. Minimise legal cycle time on what is genuinely low-risk.
The Master DPA
Template 07 in our library is a 14-clause Master DPA aligned to Section 8(2). It covers purpose limitation, security, breach notification, sub-processors, audit rights, return / destruction on termination, and the supporting schedules. Use it as your baseline for top-tier remediation.
The processor inventory artefact
Maintain a single processor inventory: vendor name, categories of personal data, purpose, sub-processors known to you, DPA status (signed / pending / expired), DDQ score, last-reviewed date. This is the artefact a regulator will ask for first when investigating any breach involving a processor.
The 'no DPA, no go-live' policy
For new vendor onboarding, the simplest control: no DPA, no production access. Make the procurement gate the enforcement point. This stops the inventory from growing faster than you can remediate it.