# DPA Privacy Risk Review

Upload a DPA. Get back the clauses that’ll cost you later — roles, transfers, liability caps, breach timelines — with redlines and a go/no-go call. Minutes, not hours.

**What it covers**  
Every agreement is reviewed across ten dimensions, each rated Sufficient, Partial, or Missing:

- Roles & scope of processing
- Subprocessors & change-notification rights
- International transfers & safeguards (SCCs, IDTA, DPF)
- Security & breach-notification timelines
- Data subject rights (DSARs)
- Data retention & deletion
- Audit rights & cooperation
- Indemnity & liability
- Regulatory mapping — GDPR Article 28, CPRA/CCPA, HIPAA
- Emerging risk & AI/ML provisions

**What you get back**  
A structured Privacy Risk Report you can act on:

- **Executive summary** — overall risk rating and a clear **Go / Conditional Go / No-Go** call
- **Findings by clause** — status, the risk, the key contract language, and what to negotiate
- **Compliance matrix** — GDPR Art. 28, CPRA/CCPA, and HIPAA side by side
- **Suggested redlines & vendor questions**, prioritized high to low

## The skill

Review a Data Processing Agreement against GDPR, CPRA/CCPA, and HIPAA standards, producing a structured Privacy Risk Report with risk ratings, clause-by-clause findings, compliance mapping, and actionable redlines.

### When to Use
- User uploads a DPA, data processing addendum, or vendor privacy agreement
- User asks for a privacy risk review of a contract
- User wants to redline or evaluate data protection terms
- User mentions reviewing vendor agreements for GDPR/CCPA/HIPAA compliance
- User references DPA compliance, subprocessor review, or international transfer analysis

## Procedure
Review the DPA across all ten dimensions below. For each dimension, classify the finding as **Sufficient**, **Partial**, or **Missing**. Quote or reference specific contract language where relevant.

### 1. Roles and Scope of Processing
- Identify whether the vendor is acting as processor, controller, joint controller, or a hybrid role
- Flag vague or overly broad processing purposes
- Check whether the DPA permits secondary uses: analytics, profiling, AI/ML model training, product improvement, or aggregated benchmarking

### 2. Subprocessors
- Confirm whether a subprocessor list is included, referenced by URL, or missing entirely
- Evaluate notification mechanism: does the controller get prior notice of changes?
- Check for approval rights (prior written consent vs. general authorization with objection window)

### 3. International Transfers
- Identify transfer safeguards: Standard Contractual Clauses (SCCs), UK International Data Transfer Agreement (IDTA)
- Check SCC module selection (Controller-to-Processor, Processor-to-Processor, etc.) for correctness

### 4. Security and Breach Notification
- Summarize security controls mentioned: encryption, access management, MFA
- Check for certifications: ISO 27001, SOC 2 Type II
- Evaluate breach notification timeline

### 5. Data Subject Rights (DSARs)
- Confirm the processor commits to assist with: access, deletion/erasure, rectification, portability, restriction, and objection requests

### 6. Data Retention and Deletion
- Review post-termination data handling: return, deletion, or certification of destruction
- Flag vague carve-outs like "except as required by applicable law" without specifying which laws or retention periods

### 7. Audit Rights and Cooperation
- Determine whether the controller has direct audit rights, third-party audit rights

### 8. Indemnity and Liability
- Review whether liability is capped (per-incident, annual aggregate)
- Identify indemnification provisions for data protection violations

### 9. Regulatory Compliance Mapping
**GDPR Article 28 checklist:**
- Processing only on documented instructions
- Confidentiality obligations on personnel

**CPRA/CCPA checklist:**
- "Service provider" or "contractor" language present

### 10. Emerging Risk and AI Provisions
- Check whether the DPA restricts AI/ML model training on customer data

### Output Format
Structure the review as a **Privacy Risk Report** with these exact sections:

## Executive Summary
- **Overall Risk Rating**: Low 🟢 / Moderate 🟠 / High 🔴
- **Recommendation**: Go / Conditional Go / No-Go
- **Rationale**: 1–2 sentence explanation of the rating and recommendation

## Findings by Clause or Topic
For each of the 10 review dimensions:
- **Status**: Sufficient ✅ / Partial ⚠️ / Missing ❌
- **Summary**: What the DPA says (or doesn't say)
- **Risk**: What could go wrong

## Compliance Matrix
A table mapping the DPA against each applicable regulation:
| Regulation | Status | Notes |
|---|---|---| 
| GDPR Art. 28 | Compliant / Partial / Gap | Brief explanation |
| CPRA/CCPA | Compliant / Partial / Gap | Brief explanation |  
| HIPAA | Compliant / Partial / Gap / N/A | Brief explanation |

## Suggested Redlines and Vendor Questions
- Draft specific contract edits for the most critical gaps
- List follow-up questions to send to the vendor for ambiguous or missing terms