# Data Processing Agreement > Draft Data Processing Agreement for data processors - Skill: `bromso/data-processing-agreement` (Agent Skill) - Install (CLI): `npx skillmds@latest add bromso/data-processing-agreement` - Raw SKILL.md: https://api.skillmd.com/api/skills/bromso/data-processing-agreement/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: bromso (https://skillmd.com/u/bromso) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/bromso/data-processing-agreement --- # Data Processing Agreement Draft a Data Processing Agreement (DPA) for "$ARGUMENTS". Define controller/processor roles and obligations, covering all GDPR Article 28 requirements for data processing arrangements. > **Note:** AI-generated legal content does not constitute legal advice. Consult a qualified attorney. ## Prerequisites Check that `.metapowers/legal/$ARGUMENTS/00-assess.md` exists. If it does not exist, stop and tell the user: > "Run an Assess skill first (e.g. `/legal:risk-assessment $ARGUMENTS`) to generate the prerequisite assessment artifact." If the user passes `--skip-checks`, bypass this check and log the skip to `.metapowers/legal/$ARGUMENTS/skip-log.md` with a timestamp and the reason "Prerequisite check skipped for data-processing-agreement". ## Process 1. **Read inputs:** - Read `.metapowers/legal/$ARGUMENTS/00-assess.md` for risk, jurisdiction, and data practice context - Read any existing contract templates or draft artifacts in `.metapowers/legal/$ARGUMENTS/` for additional context 2. **Define controller/processor roles:** - Clearly identify which party is the controller and which is the processor - Address joint controller scenarios if applicable - Document the basis for the controller-processor relationship 3. **Draft DPA sections:** **a. Subject matter and duration of processing:** - Describe the service that involves personal data processing - Specify the duration (tied to the main service agreement or specific term) **b. Nature and purpose of processing:** - Types of processing operations (collection, storage, retrieval, use, disclosure, erasure) - Business purposes for each processing operation **c. Categories of data subjects and personal data:** - List all categories of data subjects (customers, employees, end users, etc.) - List all categories of personal data processed (identifiers, contact info, financial data, usage data, etc.) - Identify any special categories of data (health, biometric, racial/ethnic origin, etc.) **d. Controller's instructions to processor:** - Processing only on documented instructions from the controller - Procedure for processor to notify controller if an instruction infringes GDPR - Mechanism for providing additional or updated instructions **e. Processor's obligations:** - **Confidentiality** — ensure persons authorized to process have committed to confidentiality or are under statutory obligation - **Security measures** (Article 32) — appropriate technical and organizational measures (encryption, pseudonymization, access controls, resilience, regular testing) - **Sub-processor management** — prior specific or general written authorization, flow-down of obligations, list of current sub-processors, notification procedure for changes, controller's right to object - **Assistance with data subject rights** — assist controller in responding to data subject requests, timelines and procedures - **Breach notification** — notify controller without undue delay after becoming aware of a breach, information to include, cooperation obligations - **DPIA assistance** — assist controller with data protection impact assessments and prior consultation with supervisory authority - **Audit rights** — make available all information necessary to demonstrate compliance, allow for and contribute to audits and inspections by controller or mandated auditor **f. Data return or deletion on termination:** - Controller's choice: return all personal data or delete all copies - Timeline for return or deletion after termination - Certification of deletion - Exceptions (legal retention obligations) **g. International transfer provisions:** - Restrictions on transfers outside EEA - Approved transfer mechanisms (SCCs, adequacy decisions, BCRs) - Transfer impact assessment requirements - SCCs incorporated by reference or as annex **h. Liability allocation:** - Liability caps and limitations specific to data processing - Indemnification provisions - Allocation of regulatory fines (if permissible under applicable law) 4. **Write the artifact** to `.metapowers/legal/$ARGUMENTS/03-comply.md` with frontmatter: ``` --- description: Data Processing Agreement for $ARGUMENTS --- ``` Include sections: - **Definitions** — key terms (personal data, processing, controller, processor, sub-processor, data breach) - **Roles and Responsibilities** — controller/processor identification - **Subject Matter and Duration** — scope and term - **Nature, Purpose, and Categories** — processing details - **Controller Instructions** — instruction framework - **Processor Obligations** — all Article 28 obligations - **Sub-Processor Management** — authorization and flow-down - **Data Subject Rights** — assistance procedures - **Security Measures** — technical and organizational measures - **Breach Notification** — procedures and timelines - **Audit Rights** — scope and procedures - **International Transfers** — mechanisms and safeguards - **Term and Termination** — data return/deletion provisions - **Liability** — allocation and limitations ## Output The Data Processing Agreement written to `.metapowers/legal/$ARGUMENTS/03-comply.md`. Present a summary to the user highlighting: - Controller and processor roles defined - Categories of data subjects and personal data covered - Sub-processor management approach (specific vs. general authorization) - International transfer mechanisms included - Key areas flagged for attorney review (especially liability allocation and indemnification)