Data Processing Agreement Reviewer
Converts vendor DPAs into traceable clause maps, issue registers, and negotiation-ready redline concepts.
$6.99
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
DeepSeek
Muse+22 moreClaude CodeCursorCodex CLIDeepSeekMuse
Dots
Manus
Grok
Grok Bot+18 agentsData Processing Agreement Reviewer
Example session with this skill installed
Review this DPA extract: Clause 4 allows subprocessor changes without notice. Clause 7 promises incident notice 'promptly'. No security annex is attached. Build an issue register.
- Read your context and instructions
- Compiled the data processing agreement
I have analyzed the provided DPA clauses and identified three critical gaps regarding subprocessor control, incident timelines, and security evidence.
DPA Review Pack
1. Scope and Coverage
| Document | Version | Status |
|---|---|---|
| DPA Extract | v1.0 | Partial |
| Security Annex | N/A | Missing |
| MSA | N/A | Missing |
4. Issue and Negotiation Register
| ID | Issue | Source | Priority | Suggested Redline / Question | Owner | Due Stage |
|---|---|---|---|---|---|---|
| 001 | No Subprocessor Notice | Clause 4 | HIGH | "Vendor must provide 30 days prior notice of new subprocessors with right to object." | Privacy | Pre-sign |
| 002 | Vague Incident Trigger | Clause 7 | MEDIUM | Define 'promptly' as 'within 48 hours of becoming aware of a breach'. | Legal Ops | Pre-sign |
| 003 | Missing Security T&Os | N/A | HIGH | Request Annex II / Technical & Organizational Measures document for review. | Security | Pre-sign |
9. Questions and Missing Documents
Security: Please provide the specific Technical and Organizational Measures (TOMs) referenced in the DPA framework.
2. Subprocessors: Can the vendor provide a current list of all third-party processors and their hosting locations?
3. Liability: How does the DPA interact with the liability cap defined in the Master Service Agreement?
Next steps
- Send the Security Annex request to the vendor account manager.
- Assign the Clause 4 redline to internal privacy counsel for jurisdiction-specific wording.
- Verify if 'promptly' meets the internal 72-hour reporting requirement for your primary jurisdiction.
Connects securely to your tools. The creator never sees your data.
About this skill
Reviewing vendor Data Processing Agreements (DPAs) manually is a high-risk bottleneck that leads to missed obligations and inconsistent risk posture. This skill transforms dense contractual text and vendor addendums into a structured, evidence-linked review pack for legal, privacy, and procurement teams.
What it does
- Clause Mapping extracts verbatim commitments and paraphrases them into a traceable obligation matrix.
- Gap Analysis identifies missing Article 28 terms, absent technical measures, and undefined breach notification triggers.
- Issue Triage categorizes risks as High, Medium, or Low with explicit negotiation rationales and redline concepts.
- Evidence Tracking flags where contractual promises lack operational proof, such as missing subprocessor lists or hosting locations.
- Hierarchy Review checks for conflicts between the DPA and Master Service Agreement (MSA) regarding liability and survival.
How it works
- Scope Intake requires the DPA, main agreement, and context like data flows and hosting locations.
- Document Indexing creates a source map of sections, schedules, and cross-references.
- Requirement Testing evaluates clauses against standards for subprocessor notice, security T&Os, and audit rights.
- Issue Register Generation produces a prioritized list of negotiation points and counsel-ready questions.
Frameworks & tools
Built for privacy professionals and legal ops using standard contract review workflows. It handles DPA, SCCs, and vendor security schedules.
Why this beats prompting it yourself
Generic prompts often hallucinate compliance status or miss subtle hierarchy conflicts between the DPA and MSA. This skill enforces a strict evidence-based methodology that separates contractual text from operational reality, ensuring every risk is tied to a specific clause ID.
Use cases
- Vendor Onboarding to screen supplier terms against internal privacy and security standards.
- Audit Preparation by mapping existing contract promises to required compliance evidence.
- Contract Remediation for updating legacy DPAs to meet new international transfer requirements.
- Negotiation Support to generate precise redlines and questions for vendor legal teams.
Known limitations
This tool provides documentary triage and issue spotting, not legal advice. It cannot determine actual controller status without factual analysis or certify statutory compliance.
Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Legal & Compliance.
Cannot certify legal compliance or perform statutory searches. Requires manual input of DPA text. Commercial risk labels are for triage, not legal interpretation.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before buying a skill.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 18 days ago