# NLP-based Automated Compliance Checking of Data Processing Agreements against GDPR

arXiv: https://arxiv.org/abs/2209.09722 · HTML: https://mlsanity.com/paper/2209.09722/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Sep 2022.

## Built on by (most cited first, 18 of 18)

- [LegalLens: Leveraging LLMs for Legal Violation Identification in Unstructured Text](https://mlsanity.com/paper/2402.04335/) (2024)
- [Enhancing Legal Compliance and Regulation Analysis with Large Language Models](https://mlsanity.com/paper/2404.17522/) (2024)
- [TAB-PO: Preference Optimization with a Token-Level Adaptive Barrier for Token-Critical Structured Generation](https://mlsanity.com/paper/2603.00025/) (2026)
- [Empirical Evaluation of ChatGPT on Requirements Information Retrieval Under Zero-Shot Setting](https://mlsanity.com/paper/2304.12562/) (2023)
- [LegalLens Shared Task 2024: Legal Violation Identification in Unstructured Text](https://mlsanity.com/paper/2410.12064/) (2024)
- [LegalRAG: A Hybrid RAG System for Multilingual Legal Information Retrieval](https://mlsanity.com/paper/2504.16121/) (2025)
- [Explainable Compliance Detection with Multi-Hop Natural Language Inference on Assurance Case Structure](https://mlsanity.com/paper/2506.08713/) (2025)
- [A Multi-solution Study on GDPR AI-enabled Completeness Checking of DPAs](https://mlsanity.com/paper/2311.13881/) (2023)
- [Legal Requirements Analysis](https://mlsanity.com/paper/2311.13871/) (2023)
- [ComplianceNLP: Knowledge-Graph-Augmented RAG for Multi-Framework Regulatory Gap Detection](https://mlsanity.com/paper/2604.23585/) (2026)
- [Legal Requirements Translation from Law](https://mlsanity.com/paper/2507.02846/) (2025)
- [Automating Geometry-Intensive Compliance Checking in BIM: Graph-Based Semantic Reasoning Framework](https://mlsanity.com/paper/2606.12065/) (2026)
- [A BERT-based Empirical Study of Privacy Policies' Compliance with GDPR](https://mlsanity.com/paper/2407.06778/) (2024)
- [Machine Learning-Based Cloud Computing Compliance Process Automation](https://mlsanity.com/paper/2502.16344/) (2025)
- [Towards Human-Centered RegTech: Unpacking Professionals' Strategies and Needs for Using LLMs Safely](https://mlsanity.com/paper/2510.01638/) (2025)
- [Cross-Domain Data Selection and Augmentation for Automatic Compliance Detection](https://mlsanity.com/paper/2604.21469/) (2026)
- [Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents](https://mlsanity.com/paper/2606.26627/) (2026)
- [IntelliAudit: Using Large Language Models to Evaluate Audit Controls](https://mlsanity.com/paper/2608.07688/) (2026)

## Abstract (arXiv)

Processing personal data is regulated in Europe by the General Data Protection Regulation (GDPR) through data processing agreements (DPAs). Checking the compliance of DPAs contributes to the compliance verification of software systems as DPAs are an important source of requirements for software development involving the processing of personal data. However, manually checking whether a given DPA complies with GDPR is challenging as it requires significant time and effort for understanding and identifying DPA-relevant compliance requirements in GDPR and then verifying these requirements in the DPA. In this paper, we propose an automated solution to check the compliance of a given DPA against GDPR. In close interaction with legal experts, we first built two artifacts: (i) the "shall" requirements extracted from the GDPR provisions relevant to DPA compliance and (ii) a glossary table defining the legal concepts in the requirements. Then, we developed an automated solution that leverages natural language processing (NLP) technologies to check the compliance of a given DPA against these "shall" requirements. Specifically, our approach automatically generates phrasal-level representations for the textual content of the DPA and compares it against predefined representations of the "shall" requirements. Over a dataset of 30 actual DPAs, the approach correctly finds 618 out of 750 genuine violations while raising 76 false violations, and further correctly identifies 524 satisfied requirements. The approach has thus an average precision of 89.1%, a recall of 82.4%, and an accuracy of 84.6%. Compared to a baseline that relies on off-the-shelf NLP tools, our approach provides an average accuracy gain of ~20 percentage points. The accuracy of our approach can be improved to ~94% with limited manual verification effort.