01

Parties and controller/processor roles must be verified.

02

Instructions, categories, purpose/duration, security, subprocessors, transfers, incident assistance, audits and return/deletion annexes require legal review.