The moment it starts

Publishing the new DPA isn’t compliance.

Terms must now be notified and approved, versioned, and provable — per client.

If nothing changes

Where this goes.

  1. Your first EU or Brazilian client: the DPA becomes a regulated document.

  2. Under GDPR, a change must be notified and approved — not merely posted (EDPB Guidelines 07/2020).

  3. Your sub-processor list changes. Every client needs the new version, and you need to prove who accepted it.

  4. A sub-processor change forces re-papering the whole book.

The frame

“Accept terms” is not “Sign.”

Same terms, a different reflex. A request to sign enters legal routing and invites redlines; a page your client accepts says “standard”, and the business owner who said yes stays the owner.

Sent to sign
Sent to accept
What it feels like
A commitment — “I’d better clear this with legal.”
Standard terms — the kind I accept every week.
Who owns it
Legal, on both sides.
The business owner who already said yes.
What happens to the text
Redlined by default — it’s a Word document.
Nothing to redline — it’s a page.

Your clients already do this every day — Meta, Google and TikTok Ads terms are accepted by click. See the same DPA sent both ways →

This week

Three things to do before the next client.

  1. Version the DPA: every text stored immutably with its hash.

  2. On every change, ask each client again — re-acceptance is tracked per client, never a silent update.

  3. Keep a certificate ready for the client who asks: named contact, time, the exact text.

Put one standard agreement on Pacts today. Free for 3 standard terms and 5 clients — no card, no time limit.

Send your first termsSee how it works