gdpr-dpa

name	gdpr-dpa
title	GDPR Data Processing Addendum (DPA)
description	Drafts GDPR Article 28-compliant Data Processing Addenda with schedules ready for execution. Use when drafting or updating a DPA, vendor GDPR addendum, controller-processor agreement, or data protection addendum involving sub-processors, breach notification, audits, international transfers, or SCCs.
author	CaseMark
author_url	https://github.com/CaseMark/skills/tree/main/skills/legal/gdpr-dpa
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	general
practice	data-protection
language	en

GDPR Data Processing Addendum (DPA)

Produces an Article 28-compliant DPA aligned with the governing service agreement, covering processing details, security, sub-processor controls, breach notice, audits, and deletion terms.

Quick Start

Gather before drafting:

• Party details: legal names, addresses, registration numbers (Controller + Processor)
• Underlying agreement reference (name, date, SOWs/order forms)
• Processing description: subject matter, duration, nature, purpose, operations
• Data inventory: data subject categories, personal data types, special categories (Art 9), criminal data (Art 10)
• Transfer map: processing locations, transfer mechanism (adequacy, SCCs, BCRs, Art 49)
• Security baseline: certifications, TOMs
• Sub-processor list + approval model (general vs specific) with objection window
• Incident response SLAs and audit preferences
• Termination: return/deletion formats, timelines, retention constraints

Drafting Workflow

1. Draft header, recitals, effective date, and order-of-precedence clause with the main agreement.
2. Define GDPR terms: Controller, Processor, Personal Data, Processing, Sub-processor, Data Protection Laws, Personal Data Breach, Services.
3. Insert Article 28(3) mandatory clauses (see checklist below).
4. Add security (Art 32), breach notification (Arts 33-34), and assistance (Arts 32-36) clauses.
5. Add sub-processor governance (Art 28(2), 28(4)) with flow-down obligations.
6. Add audit and compliance evidence provisions (Arts 28(3)(h), 40, 42).
7. If data leaves the EEA, add international transfer terms (Art 46 SCCs, Art 47 BCRs, Art 49 derogations).
8. Add termination, return/deletion obligations, and backup handling.
9. Populate Schedules A-D from inputs; mark gaps as [REQUIRED].

Article 28(3) Mandatory Clause Checklist

GDPR basis	Clause	Required content
Art 28(3)(a)	Instructions