Answer 10 questions about a vendor or processor to get a data-protection risk rating and the DPA clauses you’re missing.