| name | data-processing-addendum |
| title | GDPR Data Processing Addendum (DPA) |
| description | Drafts a GDPR Article 28-compliant Data Processing Addendum (DPA) between data controllers and processors. Extracts party details, processing scope, and service terms from uploaded documents. Produces an execution-ready DPA with all mandatory Art. 28(3) elements and four schedules. Use when supplementing a service agreement with data protection terms, negotiating processor contracts, or establishing GDPR-compliant EU data processing relationships. |
| author | CaseMark |
| author_url | https://github.com/CaseMark/skills/tree/main/skills/legal/data-processing-addendum |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
| tags | ["agreement","drafting","regulatory"] |
GDPR Data Processing Addendum (DPA)
Drafts an Art. 28-compliant DPA as a standalone addendum to an underlying service agreement, covering all mandatory processor obligations and four execution-ready schedules.
Prerequisites
Extract from uploaded documents before drafting:
- Service agreement — governing law, notice clauses, effective date, termination provisions
- Party details — legal names, addresses, registration numbers, DPO contacts (both parties)
- Processing description — subject matter, duration, nature/purpose, data types, data subject categories; flag Art. 9 special category data explicitly
- Sub-processor list — names, locations, processing activities
- Security posture — certifications (ISO 27001, SOC 2), policies, audit reports
- Transfer mechanisms — SCCs, BCRs, adequacy decisions, or TIAs for EEA transfers
Quick Start
Produce a numbered, cross-referenced document: recitals, operative provisions (Sections 1–11), signature block, and four schedules (A–D). Draft schedules in parallel with their corresponding sections.
DPA Sections
1 — Parties & Main Agreement
| Element | Requirement |
|---|
| Party identification | Full legal name, address, registration number, DPO details |
| Hierarchy | DPA prevails over main agreement on data protection matters |
| Effective date | Specify; note retroactive application if processing already underway |
| Integration | DPA forms integral part of main agreement |
2 — Processing Details (→ Schedule B)
- Subject matter & duration: Tied to service agreement term; include renewal/termination triggers
- Nature & purpose: Enumerate operations (collection, storage, analysis, transmission, deletion); confirm necessity and proportionality
- Data types: Distinguish ordinary vs. special category (Art. 9)
- Data subjects: Employees, customers, end-users, children (flag Art. 8 if applicable)
3 — Processor Instructions (Art. 28(3)(a))
