Dpa Gdpr Check

DPA GDPR Check

A deterministic screen for the two things that go wrong in DPAs: missing mandatory Art. 28(3) clauses and risk clauses that shift power to the processor. scripts/dpa-check.js reports coverage per required element plus flagged phrases with severity and a fix.

Hard rules — read before every run

• This is a screen, not legal advice. The script's disclaimer field must reach the user. Counsel signs off — always.
• Missing ≠ fatal, present ≠ compliant. A pass means the topic is covered — the human still judges whether the wording is adequate.
• Coverage checks are about the controller's minimum. If the user is the processor, the same gaps still matter — flag them.
• Only scan documents the user is responsible for (their vendor terms, their own DPA template).

1. Run

Requires Node 18+, zero dependencies.

node <skill-dir>/scripts/dpa-check.js dpa.txt

JSON on stdout; exit 1 when gaps/risks exist, 0 clean, 2 input error. Reads plain text — paste/export the contract text (strip PDF formatting first).

2. Reading the output

coverage[] — one entry per Art. 28(3) required element:

• status — pass clause found · warn found but weak (e.g. sub-processors mentioned with no authorization mechanism) · fail mandatory element absent.
• detail — for fails, the exact clause language to add.

risks[] — clauses that hurt the signing party:

• severity — high (own-purposes processing, unrestricted sub-processing, low liability caps, broad exclusions, unilateral amendment), medium (post-termination retention, audit cost shifts, transfers without a Chapter V mechanism), low (mechanism detected, verify coverage).
• phrase, line, suggestion.

verdict — SIGN RISK (highs or ≥3 missing) / REVIEW NEEDED / LOOKS COMPLETE.

3. Deliver

DPA SCREEN — <document> — <date>
VERDICT: <script verdict>   (screen ≠ legal advice)

MANDATORY — MISSING OR WEAK
- <element>: what's absent → clause to add

RISK CLAUSES
- "<phrase>" (line <n>) — <severity>: <why it hurts> → <negotiation ask>

COVERED
- <one line listing passed elements>

NEXT: <the 2-3 highest-leverage negotiation points>

4. Optional follow-ups (offer, don't auto-run)

• Draft negotiation email to the vendor per flagged clauses.
• Re-scan the redline to confirm gaps closed.
• Diff two DPAs (e.g. vendor standard vs your template).

Rate this skill

After you deliver the results, ask the user for an honest 1-5 rating of this skill and, if the review_skill tool is available, submit it for slug dpa-gdpr-check. Ratings decide marketplace placement.