GDPR Contract Review Triage Agent
Reviews contracts and DPAs for GDPR-related triage issues, extracts obligations, flags missing clauses, creates risk tables, and generates legal-review checklists.
- Review vendor DPAs for missing GDPR-required clauses before signature.
- Generate lists of privacy questions for procurement to send to new vendors.
- Extract and summarize data processing obligations from master service agreements.
Secure checkout via Stripe
Included in download
- Review vendor DPAs for missing GDPR-required clauses before signature.
- Generate lists of privacy questions for procurement to send to new vendors.
- terminal, file_write, file_read automation included
- Ready for Compatible with ChatGPT Custom GPTs
Sample Output
A real example of what this skill produces.
=== GDPR CONTRACT REVIEW TRIAGE REPORT === Legal positioning: This is legal triage and issue spotting, not legal advice. Final contract approval requires qualified legal/privacy review. Contract: SaaS Vendor Data Processing Agreement Documents reviewed: - DPA text provided by user - No main agreement provided - No security schedule provided - No subprocessor list provided Parties: Customer and SaaS vendor Likely role structure: Controller-to-processor, based on the vendor processing customer personal data to provide SaaS services. Processing summary: The vendor appears to process customer-provided personal data for service delivery, support, hosting, and related operational purposes. Personal data categories: Not clearly listed. Data subject categories: Not clearly listed. Processing purposes: Service provision is mentioned, but the purposes are broad and should be clarified. Processing duration: Not clearly defined beyond the term of the services. Overall risk rating: High Executive summary: The DPA contains basic processor language but has several gaps requiring privacy/legal review. The most important issues are missing data categories, unclear data subject categories, unclear deletion timeline, missing security schedule, no subprocessor list, and unclear international transfer mechanism. Clause presence matrix: Party roles: Found, but should be confirmed. Subject matter: Ambiguous. Duration: Ambiguous. Nature and purpose: Ambiguous. Types of personal data: Missing. Categories of data subjects: Missing. Documented instructions: Found. Confidentiality: Found. Security measures: Ambiguous. No detailed TOMs attached. Subprocessors: Ambiguous. Subprocessors appear allowed, but list and objection process are not provided. Breach notification: Found, but timeline should be reviewed. Return/deletion: Ambiguous. Deletion timing and backup handling unclear. Audit and information rights: Ambiguous. Audit rights appear limited. International transfers: Ambiguous. Transfer mechanism not clear from provided text. GDPR contract risk table: | Area | Status | Risk level | Issue | Evidence | Why it matters | Recommended human review | |---|---|---|---|---|---|---| | Data categories | Missing | High | DPA does not clearly list types of personal data | No schedule provided | Processing scope is incomplete | Privacy/legal | | Data subjects | Missing | High | Data subject categories not listed | No schedule provided | Required for understanding scope | Privacy/legal | | Security measures | Ambiguous | High | TOMs are vague or missing | No security schedule | Security obligations may be insufficient | Security/privacy | | Subprocessors | Ambiguous | High | No subprocessor list or objection process provided | DPA references subprocessors | Onward processing risk | Privacy/procurement | | Transfers | Ambiguous | High | Transfer locations/mechanism unclear | No transfer schedule/SCCs provided | Cross-border transfer review needed | Privacy/legal | | Deletion | Ambiguous | Medium | Deletion timeline and backups unclear | End-of-services language vague | Retention risk | Legal/privacy | Questions for vendor: 1. Please provide the current subprocessor list, including processing locations and services performed. 2. Please identify all personal data categories and data subject categories processed under the services. 3. Please provide the technical and organizational measures/security schedule. 4. Please confirm whether personal data is transferred outside the EEA/UK and identify the applicable transfer mechanism. 5. Please clarify deletion timing, backup deletion, and whether deletion confirmation is available. 6. Please clarify breach notification timing and information included in notices. Questions for internal legal/privacy team: 1. Is this relationship correctly classified as controller-to-processor? 2. Are the vendor’s security measures sufficient for the data involved? 3. Is the liability cap acceptable for the processing risk? 4. Are the transfer terms acceptable after vendor clarification? Suggested redline comments: Comment: Please add a schedule listing the categories of personal data, categories of data subjects, processing purposes, processing duration, and processing locations. Comment: Please provide a current subprocessor list and clarify notice and objection rights for new subprocessors. Legal-review checklist: - confirm role classification - confirm processing scope - confirm subprocessor controls - confirm transfer mechanism - confirm TOMs - confirm breach timeline - confirm deletion/return process - confirm audit rights - confirm liability alignment - confirm order of precedence with main agreement Audit-ready review record: Reviewer: [Name] Date: [Date] Documents reviewed: DPA only Review scope: GDPR contract triage Final status: Not ready for approval. Vendor clarification and legal/privacy review required. Final triage recommendation: Do not treat this DPA as ready for signature until the missing schedules, subprocessor information, security measures, transfer mechanism, and deletion terms are clarified and reviewed by legal/privacy counsel.
GDPR Contract Review Triage Agent
Reviews contracts and DPAs for GDPR-related triage issues, extracts obligations, flags missing clauses, creates risk tables, and generates legal-review checklists.
Secure checkout via Stripe
Included in download
- Review vendor DPAs for missing GDPR-required clauses before signature.
- Generate lists of privacy questions for procurement to send to new vendors.
- terminal, file_write, file_read automation included
- Ready for Compatible with ChatGPT Custom GPTs
- Instant install
Sample Output
A real example of what this skill produces.
=== GDPR CONTRACT REVIEW TRIAGE REPORT === Legal positioning: This is legal triage and issue spotting, not legal advice. Final contract approval requires qualified legal/privacy review. Contract: SaaS Vendor Data Processing Agreement Documents reviewed: - DPA text provided by user - No main agreement provided - No security schedule provided - No subprocessor list provided Parties: Customer and SaaS vendor Likely role structure: Controller-to-processor, based on the vendor processing customer personal data to provide SaaS services. Processing summary: The vendor appears to process customer-provided personal data for service delivery, support, hosting, and related operational purposes. Personal data categories: Not clearly listed. Data subject categories: Not clearly listed. Processing purposes: Service provision is mentioned, but the purposes are broad and should be clarified. Processing duration: Not clearly defined beyond the term of the services. Overall risk rating: High Executive summary: The DPA contains basic processor language but has several gaps requiring privacy/legal review. The most important issues are missing data categories, unclear data subject categories, unclear deletion timeline, missing security schedule, no subprocessor list, and unclear international transfer mechanism. Clause presence matrix: Party roles: Found, but should be confirmed. Subject matter: Ambiguous. Duration: Ambiguous. Nature and purpose: Ambiguous. Types of personal data: Missing. Categories of data subjects: Missing. Documented instructions: Found. Confidentiality: Found. Security measures: Ambiguous. No detailed TOMs attached. Subprocessors: Ambiguous. Subprocessors appear allowed, but list and objection process are not provided. Breach notification: Found, but timeline should be reviewed. Return/deletion: Ambiguous. Deletion timing and backup handling unclear. Audit and information rights: Ambiguous. Audit rights appear limited. International transfers: Ambiguous. Transfer mechanism not clear from provided text. GDPR contract risk table: | Area | Status | Risk level | Issue | Evidence | Why it matters | Recommended human review | |---|---|---|---|---|---|---| | Data categories | Missing | High | DPA does not clearly list types of personal data | No schedule provided | Processing scope is incomplete | Privacy/legal | | Data subjects | Missing | High | Data subject categories not listed | No schedule provided | Required for understanding scope | Privacy/legal | | Security measures | Ambiguous | High | TOMs are vague or missing | No security schedule | Security obligations may be insufficient | Security/privacy | | Subprocessors | Ambiguous | High | No subprocessor list or objection process provided | DPA references subprocessors | Onward processing risk | Privacy/procurement | | Transfers | Ambiguous | High | Transfer locations/mechanism unclear | No transfer schedule/SCCs provided | Cross-border transfer review needed | Privacy/legal | | Deletion | Ambiguous | Medium | Deletion timeline and backups unclear | End-of-services language vague | Retention risk | Legal/privacy | Questions for vendor: 1. Please provide the current subprocessor list, including processing locations and services performed. 2. Please identify all personal data categories and data subject categories processed under the services. 3. Please provide the technical and organizational measures/security schedule. 4. Please confirm whether personal data is transferred outside the EEA/UK and identify the applicable transfer mechanism. 5. Please clarify deletion timing, backup deletion, and whether deletion confirmation is available. 6. Please clarify breach notification timing and information included in notices. Questions for internal legal/privacy team: 1. Is this relationship correctly classified as controller-to-processor? 2. Are the vendor’s security measures sufficient for the data involved? 3. Is the liability cap acceptable for the processing risk? 4. Are the transfer terms acceptable after vendor clarification? Suggested redline comments: Comment: Please add a schedule listing the categories of personal data, categories of data subjects, processing purposes, processing duration, and processing locations. Comment: Please provide a current subprocessor list and clarify notice and objection rights for new subprocessors. Legal-review checklist: - confirm role classification - confirm processing scope - confirm subprocessor controls - confirm transfer mechanism - confirm TOMs - confirm breach timeline - confirm deletion/return process - confirm audit rights - confirm liability alignment - confirm order of precedence with main agreement Audit-ready review record: Reviewer: [Name] Date: [Date] Documents reviewed: DPA only Review scope: GDPR contract triage Final status: Not ready for approval. Vendor clarification and legal/privacy review required. Final triage recommendation: Do not treat this DPA as ready for signature until the missing schedules, subprocessor information, security measures, transfer mechanism, and deletion terms are clarified and reviewed by legal/privacy counsel.
About This Skill
GDPR Contract Review Triage Agent helps EU companies, SaaS businesses, legal teams, privacy teams, compliance consultants, procurement teams, and DPO offices perform structured first-pass GDPR contract review. It analyzes contracts, DPAs, privacy addenda, vendor agreements, security schedules, subprocessor terms, SCC references, retention clauses, breach notification terms, audit rights, assistance obligations, data transfer language, and liability provisions. The skill extracts obligations, identifies missing or ambiguous clauses, creates clause presence matrices, risk tables, vendor questions, redline comment suggestions, legal-review checklists, obligation inventories, and audit-ready review records. It is framed as legal triage and issue spotting, not legal advice or final contract approval.
Use Cases
- Review vendor DPAs for missing GDPR-required clauses before signature.
- Generate lists of privacy questions for procurement to send to new vendors.
- Extract and summarize data processing obligations from master service agreements.
- Automate legal-review checklists for internal privacy teams.
- Flag risky liability caps or breach notification timelines in vendor docs.
Known Limitations
This skill supports GDPR-related contract triage and issue spotting, but it does not provide legal advice, legal opinions, final compliance determinations, regulatory conclusions, or contract approval. Contract interpretation depends on jurisdiction, governing law, full document set, negotiation context, processing facts, data categories, transfer locations, risk tolerance, and qualified legal/privacy review. International transfers, SCCs, liability, special category data, children’s data, high-risk processing, government access requests, and regulatory obligations require specialist review.
How to Install
mkdir -p ~/.claude/skills && curl -sL https://www.agensi.io/api/install/gdpr-contract-review-triage-agent | tar xz -C ~/.claude/skills/Free skills install directly. Paid skills require purchase - use the download button above after buying.
Reviews
No reviews yet - be the first to share your experience.
Only users who have downloaded or purchased this skill can leave a review.
Early access skill
Be the first to review this skill.
Only users who have downloaded or purchased this skill can leave a review.
Security Scanned
Passed automated security review
Permissions
File Scopes
This skill uses file access to read user-provided contracts, DPAs, privacy addenda, SCCs, security schedules, subprocessor lists, vendor questionnaires, procurement notes, clause checklists, legal playbooks, and review templates. It uses write access to create structured Markdown/text outputs such as GDPR contract triage reports, DPA gap analyses, clause presence matrices, risk tables, obligation inventories, vendor question lists, legal-review checklists, redline comment suggestions, audit-ready review records, and SKILL.md files. Browser access is optional and should only be used for official public guidance or public documentation when explicitly requested. The default safe setup does not require network access, shell access, environment variable access, or automatic email sending.
Tags
Compatible with ChatGPT Custom GPTs, ChatGPT Agents, Claude-style workflows, Cursor, Claude Code, Codex CLI, OpenCode, Replit, legal operations workflows, privacy review playbooks, contract intake processes, and other AI agent systems that support structured Markdown instruction files such as SKILL.md. It can also be used manually in any AI chat by pasting the instructions. For real contract review, use qualified legal/privacy review before relying on conclusions or signing agreements.