gdpr-dpa

Drafts GDPR Article 28-compliant Data Processing Addenda with schedules ready for execution. Use when drafting or updating a DPA, vendor GDPR addendum, controller-processor agreement, or data protection addendum involving sub-processors, breach notification, audits, international transfers, or SCCs.

Jump to install

Repository: ThomasMoreAI/legal-skills-open
Last source activity: May 27, 2026 at 14:27
Detected SKILL.md language: English
Stars: 40
Forks: 4

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/ThomasMoreAI/legal-skills-open --skill gdpr-dpa

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

fetching-arbitration-rules

Use when retrieving arbitration institutional rules (ICC, LCIA, SCC, SIAC, HKIAC, VIAC, МКАС/МАК при ТПП України, UNCITRAL) — fetching current version, verifying redaction applicable to the date of arbitration agreement, constructing URLs for official rule texts

2026-06-12

determining-pl-request-regime

Use when choosing the Polish legal regime for letters, requests, applications, complaints, petitions, public-information requests, KPA filings, PPSA complaints, RODO access requests, registry extracts, court-file access, tax/ZUS/cudzoziemcy/USC procedures, or professional lawyer letters. Prevents mixing UDIP, KPA, PPSA, RODO, registry, special-procedure, and advocate/radca letter regimes.

2026-06-12

applying-new-york-convention

Use when preparing applications for recognition and enforcement of foreign arbitral awards in Poland, applications for setting aside arbitral awards under KPC art. 1205–1211, or opposing such applications — mapping Article V of the 1958 New York Convention to art. 1214–1215 of the Polish KPC, identifying grounds for refusal, structuring public policy arguments

2026-06-12

View all from this repository

GDPR Data Processing Addendum (DPA)

Produces an Article 28-compliant DPA aligned with the governing service agreement, covering processing details, security, sub-processor controls, breach notice, audits, and deletion terms.

Quick Start

Gather before drafting:

Party details: legal names, addresses, registration numbers (Controller + Processor)

Underlying agreement reference (name, date, SOWs/order forms)

Processing description: subject matter, duration, nature, purpose, operations

Data inventory: data subject categories, personal data types, special categories (Art 9), criminal data (Art 10)

Transfer map: processing locations, transfer mechanism (adequacy, SCCs, BCRs, Art 49)

Security baseline: certifications, TOMs

Sub-processor list + approval model (general vs specific) with objection window

Incident response SLAs and audit preferences

Termination: return/deletion formats, timelines, retention constraints

Drafting Workflow

Draft header, recitals, effective date, and order-of-precedence clause with the main agreement.

Define GDPR terms: Controller, Processor, Personal Data, Processing, Sub-processor, Data Protection Laws, Personal Data Breach, Services.

Insert Article 28(3) mandatory clauses (see checklist below).

Add security (Art 32), breach notification (Arts 33-34), and assistance (Arts 32-36) clauses.

Add sub-processor governance (Art 28(2), 28(4)) with flow-down obligations.

Add audit and compliance evidence provisions (Arts 28(3)(h), 40, 42).

If data leaves the EEA, add international transfer terms (Art 46 SCCs, Art 47 BCRs, Art 49 derogations).

Add termination, return/deletion obligations, and backup handling.

Populate Schedules A-D from inputs; mark gaps as [REQUIRED].

Article 28(3) Mandatory Clause Checklist

GDPR basis

Clause

Required content

Art 28(3)(a)

Instructions