gdpr-data-processing-addendum

name	gdpr-data-processing-addendum
title	GDPR Data Processing Addendum (DPA)
description	Drafts an Article 28-aligned GDPR Data Processing Addendum (DPA) as an attachable annex for SaaS, cloud, or outsourcing agreements. Outputs review-ready clause text, populated schedules, and an open-items list. Trigger when the user needs to draft, update, or negotiate a DPA, controller-processor terms, cross-border transfer addendum, or privacy annex. Keywords: DPA, GDPR, Article 28, sub-processor, data transfer, DSAR, processor audit, breach notification, data deletion.
author	CaseMark
author_url	https://github.com/CaseMark/skills/tree/main/skills/legal/gdpr-data-processing-addendum
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	general
practice	data-protection
language	en
tags	["agreement","drafting","regulatory"]

GDPR Data Processing Addendum (DPA)

Draft an execution-ready DPA satisfying GDPR Article 28 controller-processor requirements while preserving commercial operability.

Prerequisites

Collect before drafting:

1. Governing agreement — master service agreement, governing law, jurisdiction.
2. Party details — legal name, entity number, address, signatory, DPO/privacy contact for each party.
3. Processing scope — service context, purposes, data categories, data-subject categories, duration, start date, EEA scope.
4. Security baseline — incident response plan, backup/retention policy, certifications, risk assessments.
5. Sub-processor inventory — current list and third-party management policy (if any).
6. Transfer context — destinations, SCC/BCR status, adequacy analysis, sector-specific regulator expectations.
7. Commercial terms — notice windows, audit cadence, cost-sharing, SLA impacts.

Workflow

1. Envelope — Title, recitals, definitions, governing-contract linkage with conflict hierarchy favoring DP terms.
2. Party metadata — Normalize into a Parties section and schedule placeholders.
3. Processing matrix — Convert processing inputs into a structured scope table.
4. Clause insertion (in order):
   1. Scope / purpose / nature / duration
   2. Processor instructions and purpose limitation
   3. Confidentiality and security
   4. Sub-processor controls
   5. Data-subject rights assistance
   6. Breach notification and cooperation
   7. Audit and compliance assistance
   8. Transfer safeguards
   9. Return / deletion
   10. Liability, indemnity, termination, signatures
5. Schedules — Populate appendices; flag missing items as open inputs.
6. Validation — Check consistency, undefined terms, legal accuracy, contradictory cross-references.
7. Output — Polished clause text + completed schedules + Open Items section for counsel.

Section Reference

Section	Output	Key inputs
Parties	Controller/processor identification and roles