DPA Privacy Risk Review

Upload a DPA. Get back the clauses that’ll cost you later — roles, transfers, liability caps, breach timelines — with redlines and a go/no-go call. Minutes, not hours.

What it covers
Every agreement is reviewed across ten dimensions, each rated Sufficient, Partial, or Missing:

• Roles & scope of processing
• Subprocessors & change-notification rights
• International transfers & safeguards (SCCs, IDTA, DPF)
• Security & breach-notification timelines
• Data subject rights (DSARs)
• Data retention & deletion
• Audit rights & cooperation
• Indemnity & liability
• Regulatory mapping — GDPR Article 28, CPRA/CCPA, HIPAA
• Emerging risk & AI/ML provisions

What you get back
A structured Privacy Risk Report you can act on:

• Executive summary — overall risk rating and a clear Go / Conditional Go / No-Go call
• Findings by clause — status, the risk, the key contract language, and what to negotiate
• Compliance matrix — GDPR Art. 28, CPRA/CCPA, and HIPAA side by side
• Suggested redlines & vendor questions, prioritized high to low

The skill

Review a Data Processing Agreement against GDPR, CPRA/CCPA, and HIPAA standards, producing a structured Privacy Risk Report with risk ratings, clause-by-clause findings, compliance mapping, and actionable redlines.

When to Use

• User uploads a DPA, data processing addendum, or vendor privacy agreement
• User asks for a privacy risk review of a contract
• User wants to redline or evaluate data protection terms
• User mentions reviewing vendor agreements for GDPR/CCPA/HIPAA compliance
• User references DPA compliance, subprocessor review, or international transfer analysis

Procedure

Review the DPA across all ten dimensions below. For each dimension, classify the finding as Sufficient, Partial, or Missing. Quote or reference specific contract language where relevant.

1. Roles and Scope of Processing

• Identify whether the vendor is acting as processor, controller, joint controller, or a hybrid role
• Flag vague or overly broad processing purposes
• Check whether the DPA permits secondary uses: analytics, profiling, AI/ML model training, product improvement, or aggregated benchmarking

2. Subprocessors

• Confirm whether a subprocessor list is included, referenced by URL, or missing entirely
• Evaluate notification mechanism: does the controller get prior notice of changes?
• Check for approval rights (prior written consent vs. general authorization with objection window)

3. International Transfers

• Identify transfer safeguards: Standard Contractual Clauses (SCCs), UK International Data Transfer Agreement (IDTA)
• Check SCC module selection (Controller-to-Processor, Processor-to-Processor, etc.) for correctness

4. Security and Breach Notification

• Summarize security controls mentioned: encryption, access management, MFA
• Check for certifications: ISO 27001, SOC 2 Type II
• Evaluate breach notification timeline

5. Data Subject Rights (DSARs)

• Confirm the processor commits to assist with: access, deletion/erasure, rectification, portability, restriction, and objection requests

6. Data Retention and Deletion

• Review post-termination data handling: return, deletion, or certification of destruction
• Flag vague carve-outs like "except as required by applicable law" without specifying which laws or retention periods

7. Audit Rights and Cooperation

• Determine whether the controller has direct audit rights, third-party audit rights

8. Indemnity and Liability

• Review whether liability is capped (per-incident, annual aggregate)
• Identify indemnification provisions for data protection violations

9. Regulatory Compliance Mapping

GDPR Article 28 checklist:

• Processing only on documented instructions
• Confidentiality obligations on personnel

CPRA/CCPA checklist:

• "Service provider" or "contractor" language present

10. Emerging Risk and AI Provisions

• Check whether the DPA restricts AI/ML model training on customer data

Output Format

Structure the review as a Privacy Risk Report with these exact sections:

Executive Summary

• Overall Risk Rating: Low 🟢 / Moderate 🟠 / High 🔴
• Recommendation: Go / Conditional Go / No-Go
• Rationale: 1–2 sentence explanation of the rating and recommendation

Findings by Clause or Topic

For each of the 10 review dimensions:

• Status: Sufficient ✅ / Partial ⚠️ / Missing ❌
• Summary: What the DPA says (or doesn't say)
• Risk: What could go wrong

Compliance Matrix

A table mapping the DPA against each applicable regulation:

Suggested Redlines and Vendor Questions

• Draft specific contract edits for the most critical gaps
• List follow-up questions to send to the vendor for ambiguous or missing terms