| name | dpa-checklist-review |
| title | DPA Checklist Review |
| description | Use when the user provides a Data Processing Agreement, Data Processing Addendum, or HIPAA Business Associate Agreement and asks whether it contains the terms required under the applicable data-protection regime. Produces a structured checklist scoring each required term as present, partial, missing, or unclear, with clause references and recommended language for any gaps. Supports GDPR Article 28, US state privacy laws (CCPA/CPRA, VCDPA, CPA, CTDPA, and similar), HIPAA BAAs, and general commercial DPAs without a specified regime. |
| author | LegalQuants |
| author_url | https://github.com/LegalQuants/lq-ai/tree/main/skills/dpa-checklist-review |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | cross-jurisdiction |
| practice | data-protection |
| language | en |
DPA Checklist Review
Conduct a structured compliance review of a Data Processing Agreement, DPA-equivalent addendum, or Business Associate Agreement against the requirements of the applicable regulatory regime. The output is a checklist suitable for a compliance tracker — each required term has a row, an assessment, and a clause reference.
When this skill applies
Apply when the user provides a DPA, DPA addendum, or BAA and asks for compliance review against a specific regulatory regime. The skill works against four distinct regimes (see regulatory_regime input) and applies different requirements for each.
Do not apply this skill to:
- Privacy policies. Those are public-facing notices, not contracts; different review skill needed.
- Standalone privacy schedules or security exhibits inside larger agreements where the privacy/security terms have not been collected into a DPA structure. Tell the user the substantive privacy and security terms need to be pulled into a DPA-shaped structure before this skill is useful.
- Contractual privacy clauses inside MSAs that have not been broken out as a DPA addendum. Recommend the user request a separate DPA addendum from the counterparty, which is now industry standard.
- Cross-regime analysis (e.g., "is this GDPR-compliant and HIPAA-compliant?"). Run the skill twice with different
regulatory_regime values and compare outputs.
Inputs
The skill requires the document and the regulatory regime. If regime is not provided:
"Before I review, which regulatory regime should I check this DPA against?
- GDPR (EU/UK GDPR Article 28; covers any DPA processing EU/UK personal data)
- US state privacy (CCPA/CPRA, Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Oregon OCPA, and similar)
- HIPAA BAA (Business Associate Agreement under US healthcare law)
- General commercial (DPA without a specific regime; checks commercially-standard DPA terms)
If multiple regimes apply, pick the most prescriptive (typically GDPR) for the primary review; we can run additional reviews for other regimes after."
Do not guess the regime from document title or governing law. A document titled "Data Processing Addendum" with Delaware governing law could be GDPR-driven (because it processes EU resident data), CCPA-driven (because it processes California resident data), or both. Only the user knows what data is in scope.
Optional inputs (party_role, data_categories, international_transfer_context, standard_positions) refine the analysis. The input materially changes severity calibration:
