Draft Data Processing Addendum

Skill: Draft Data Processing Addendum

1. Subject-matter triage (only if applicable)

• Treat the MSA as the governing commercial contract and the DPA as a controller-protective exhibit that must integrate cleanly with it, not conflict with it.
• Identify whether the processing includes regulated health data, protected health information, or other sensitive categories; if so, preserve consistency with any separate healthcare privacy, confidentiality, or security regime that also applies.
• Confirm which data roles apply to each party and which services actually involve personal data processing; do not draft to hypothetical processing outside the deal scope.
• If multiple data categories, jurisdictions, or service lines appear, enumerate them first and then draft the operative provisions and annexes against that full set.
• Build the annexes from the deal documents and security materials, not from generic boilerplate.

2. Failure modes the skill is correcting

• Drafting from the vendor’s template with surface edits instead of resetting to a controller-protective baseline.
• Preserving vendor-favorable positions on sub-processor control, audit limitations, assistance obligations, retention, and liability allocation.
• Addressing general privacy concepts while missing the healthcare-specific overlay and any required consistency with parallel health privacy obligations.
• Treating sub-processors as a notice-only issue rather than a meaningful approval-and-flow-down control.
• Omitting or under-specifying the processing annexes that make the DPA operational.
• Failing to translate security documents into contractual minimums, resulting in an exhibit that is aspirational rather than enforceable.
• Producing a memo that describes issues without naming the governing rule, the affected contract interaction, and the practical consequence.

3. Legal frameworks / domain conventions that apply

• Controller-processor / service-provider structure: require processing only on documented instructions, confidentiality, security appropriate to risk, assistance with rights and incidents, deletion or return, audit cooperation, and compliance demonstration.
• Healthcare privacy overlay: if regulated health data is in scope, align the DPA with any separate healthcare privacy framework and avoid internal inconsistencies between exhibits.
• Sub-processor control: require prior approval or a tightly controlled notice-and-objection process, plus equivalent flow-down obligations and responsibility for subcontracted performance.
• Security contracting: translate the company’s information-security standard into contractual requirements that cover access controls, encryption, incident response, vulnerability management, logging, training, and segregation where relevant.
• Data subject rights and incident obligations: specify response timing, cooperation duties, and content requirements sufficient for the controller to meet downstream legal deadlines.
• Retention and deletion: require return or deletion at end of services, certify completion where appropriate, and preserve only limited legally required copies under controlled safeguards.
• Audit and compliance evidence: third-party reports may supplement but do not replace contractual inspection rights or meaningful compliance demonstrations.
• Liability and remedy alignment: ensure the DPA remedies, indemnity posture, and liability carve-outs do not undercut the MSA’s risk allocation.

4. Analytical scaffolds

• Start from the company’s required position, then compare the vendor template clause by clause and rewrite the DPA to the more protective position where the documents support it.
• For each core provision, test whether it answers four questions: what data, what purpose, what controls, and what remedy if the processor deviates.
• For each annex, use source-document extraction: processing description, categories, durations, transfer geography if relevant, security controls, and subprocessors.
• For healthcare-related scope, check whether the processing description, confidentiality language, and incident obligations need a parallel reference to the applicable health-data regime.
• For sub-processors, draft the control mechanism in sequence: disclosure, approval, objection, onboarding conditions, onward flow-down, and liability for failure.
• For the negotiation memo, identify only material departures from the company baseline; for each, state the company position, the vendor position, the risk, and a practical fallback.
• When a source document is silent, draft conservatively and flag the gap in the memo rather than assuming vendor-favorable silence.
• Use a clause-level consistency check so the DPA, MSA, security exhibit, and annexes do not conflict on definitions, precedence, term, or breach notice mechanics.

5. Vertical / structural / temporal relationships (only if applicable)

• Make the DPA an exhibit that expressly incorporates the MSA, but preserve the DPA as the controlling privacy-specific addendum where its subject matter is more specific.
• Resolve vertical hierarchy expressly: MSA general terms, then DPA-specific processing terms, then annexes describing the operational details.
• Align temporal obligations: commencement of processing, onboarding of any sub-processor, security implementation timing, incident notice timing, deletion/return timing, and post-termination survival.
• If multiple affiliated entities, service modules, or data environments are in scope, map each to the applicable processing description and security controls before drafting obligations.
• Where a healthcare overlay exists, make the interaction rule explicit so one framework does not dilute the other by implication.

6. Output structure conventions

• Draft the DPA as a complete, controller-protective exhibit ready to attach to the MSA, with operative clauses plus complete annexes.
• Include all core privacy provisions in integrated contract form rather than in a checklist or commentary style.
• Ensure annexes are populated with deal-specific content and not placeholder text.
• Prepare the negotiation issues memo as a concise issue-by-issue advisory comparing the vendor template against the company’s required position.
• For each memo issue, state the governing rule or contractual convention, the disagreement, the company position, the likely fallback, and the practical consequence of compromise.
• Use an ordinal severity label for each memo issue and keep the scale consistent throughout the memo.
• End the memo with concrete recommended actions directed to the appropriate internal role and tied to the deal timeline.
• Keep the drafting deliverable and the memo distinct; do not let the memo substitute for the operative DPA.
• Before finishing, confirm the DPA file exists and is non-empty, and then confirm the memo file exists and is non-empty.