Draft Data Processing Agreement

Skill: Draft GDPR-Compliant Data Processing Agreement for Cross-Border Health Data Analytics Engagement

1. Subject-matter triage

• Determine whether the engagement involves controller/processor processing, joint controllership, or a service relationship that is not truly Article 28 processing; the agreement must match the actual role allocation in the source materials.
• Identify whether special-category health data, cross-border transfers, subprocessors, security commitments, and deletion/return obligations are in scope before drafting operative provisions.
• If more than one document set governs the deal, map which source is controlling for each topic before writing; do not merge inconsistent standards into generic drafting.

2. Failure modes the skill is correcting

• Drafting from the processor’s template alone and missing conflicts with the controller’s governance materials, impact findings, or transfer analysis.
• Failing to apply the more protective standard when source documents diverge on security, subprocessing, retention, audit, breach notice, or transfer safeguards.
• Leaving out health-data specificity and producing boilerplate Article 28 language that does not reflect the actual processing, access model, or operational controls.
• Omitting the cross-border transfer mechanism or supplementary safeguards where transfer analysis requires them.
• Treating assessment mitigation items as informal notes instead of binding contractual obligations.
• Producing the agreement without a separate client cover memo that explains key drafting choices and unresolved items.
• Drafting a memo that describes the work but does not identify conflict resolutions, open points, and the legal basis for the choices made.

3. Legal frameworks / domain conventions that apply

• GDPR Article 28 sets the mandatory controller-processor contract terms; the agreement must include the required subject-matter, duration, nature and purpose, categories of data, data subject types, controller obligations, processor obligations, and assistance commitments.
• GDPR Article 9 requires careful treatment of special-category health data and should inform restrictions, safeguards, and access controls.
• GDPR Chapter V governs international transfers; if the engagement includes a third-country transfer, the agreement should incorporate the applicable transfer mechanism and any contractually required supplementary measures.
• Standard contractual transfer clauses, where used, must be aligned with the transfer-impact analysis and the actual data flows described in the deal materials.
• Security and privacy-by-design obligations should be drafted as operational commitments, not aspirational language, and should reflect the actual technical and organizational measures described in the source documents.
• Data processing agreement conventions for health analytics usually require annexed details for processing scope, parties, data subjects, data categories, security measures, and approved subprocessors.
• Where the source set contains competing standards, the more protective standard controls unless the instructions or governing agreement clearly require otherwise.

4. Analytical scaffolds

• Start with a source hierarchy: identify the documents that define scope, role allocation, security baseline, transfer position, and commercial override terms.
• Read the controller-facing governance materials first to anchor the protective baseline; then test the processor template against that baseline and flag every inconsistency.
• Translate assessment findings into contractual language: any mitigation measure identified in the risk materials should become an express obligation, control, or condition in the draft.
• For transfer issues, confirm the destination, mechanism, and supplemental protections before finalizing operative clauses; if the transfer analysis leaves a condition unresolved, surface it as an open item.
• Populate the agreement with engagement-specific details in the body and annexes; avoid generic placeholders where the source materials provide facts.
• Resolve conflicts clause-by-clause, favoring the more protective standard, and preserve a short drafting rationale for each material choice in the cover memo.
• Check consistency between the agreement and the commercial master document so the DPA supplements, rather than contradicts, the broader service arrangement.
• Keep the memo decision-focused: what was chosen, why it was chosen, what remains open, and who must decide.

5. Vertical / structural / temporal relationships

• Role allocation in the service materials drives the Article 28 structure; if roles shift, the contract architecture must shift with them.
• Risk assessment findings generate mitigation commitments; those commitments should appear as binding clauses, annex entries, or conditions precedent.
• Transfer conclusions constrain drafting options; any clause on onward transfer, subprocessing, or audit must be consistent with the transfer mechanism and supplementary measures.
• Commercial terms in the master agreement set the outer frame; the DPA should be supplemental and consistent, not duplicative or contradictory.

6. Output structure conventions

• Produce the execution-ready DPA first, then the client cover memo.
• The DPA should use conventional legal architecture: parties, recitals, defined terms, processing terms, confidentiality and security, assistance, subprocessors, breach notification, audits, return/deletion, cross-border transfer terms if applicable, and annexes with factual schedules.
• Annexes should carry the engagement-specific facts: controller/processor identities, processing description, categories of data subjects and data, jurisdictions, security measures, and approved subprocessors or approval mechanics.
• Use the more protective drafting where source documents conflict, and reflect the resolution in the memo.
• The cover memo should briefly explain key drafting decisions, identify open items needing client instruction, and note any assumptions made because the source set was incomplete.
• The memo should also identify any transfer or security conditions that must be confirmed before signature.
• Deliver the documents in the filenames exactly requested, with the agreement as the primary deliverable and the memo as the secondary deliverable.