# Draft Data Processing Agreement > Drafting a GDPR-compliant data processing agreement for a cross-border health data analytics engagement fails when the agent does not reconcile conflicts among the controller’s data governance materials, the processor’s standard template, and the transfer-impact analysis before drafting, and does not apply the more protective standard where instructed. - Skill: `finchipaiorg/draft-data-processing-agreement` (Agent Skill) - Install (CLI): `npx skillmds@latest add finchipaiorg/draft-data-processing-agreement` - Raw SKILL.md: https://api.skillmd.com/api/skills/finchipaiorg/draft-data-processing-agreement/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Data & Analytics - Author: FinchipAIOrg (https://skillmd.com/u/finchipaiorg) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/finchipaiorg/draft-data-processing-agreement --- # Skill: Draft GDPR-Compliant Data Processing Agreement for Cross-Border Health Data Analytics Engagement ## 1. Subject-matter triage - Determine whether the engagement involves controller/processor processing, joint controllership, or a service relationship that is not truly Article 28 processing; the agreement must match the actual role allocation in the source materials. - Identify whether special-category health data, cross-border transfers, subprocessors, security commitments, and deletion/return obligations are in scope before drafting operative provisions. - If more than one document set governs the deal, map which source is controlling for each topic before writing; do not merge inconsistent standards into generic drafting. ## 2. Failure modes the skill is correcting - Drafting from the processor’s template alone and missing conflicts with the controller’s governance materials, impact findings, or transfer analysis. - Failing to apply the more protective standard when source documents diverge on security, subprocessing, retention, audit, breach notice, or transfer safeguards. - Leaving out health-data specificity and producing boilerplate Article 28 language that does not reflect the actual processing, access model, or operational controls. - Omitting the cross-border transfer mechanism or supplementary safeguards where transfer analysis requires them. - Treating assessment mitigation items as informal notes instead of binding contractual obligations. - Producing the agreement without a separate client cover memo that explains key drafting choices and unresolved items. - Drafting a memo that describes the work but does not identify conflict resolutions, open points, and the legal basis for the choices made. ## 3. Legal frameworks / domain conventions that apply - GDPR Article 28 sets the mandatory controller-processor contract terms; the agreement must include the required subject-matter, duration, nature and purpose, categories of data, data subject types, controller obligations, processor obligations, and assistance commitments. - GDPR Article 9 requires careful treatment of special-category health data and should inform restrictions, safeguards, and access controls. - GDPR Chapter V governs international transfers; if the engagement includes a third-country transfer, the agreement should incorporate the applicable transfer mechanism and any contractually required supplementary measures. - Standard contractual transfer clauses, where used, must be aligned with the transfer-impact analysis and the actual data flows described in the deal materials. - Security and privacy-by-design obligations should be drafted as operational commitments, not aspirational language, and should reflect the actual technical and organizational measures described in the source documents. - Data processing agreement conventions for health analytics usually require annexed details for processing scope, parties, data subjects, data categories, security measures, and approved subprocessors. - Where the source set contains competing standards, the more protective standard controls unless the instructions or governing agreement clearly require otherwise. ## 4. Analytical scaffolds - Start with a source hierarchy: identify the documents that define scope, role allocation, security baseline, transfer position, and commercial override terms. - Read the controller-facing governance materials first to anchor the protective baseline; then test the processor template against that baseline and flag every inconsistency. - Translate assessment findings into contractual language: any mitigation measure identified in the risk materials should become an express obligation, control, or condition in the draft. - For transfer issues, confirm the destination, mechanism, and supplemental protections before finalizing operative clauses; if the transfer analysis leaves a condition unresolved, surface it as an open item. - Populate the agreement with engagement-specific details in the body and annexes; avoid generic placeholders where the source materials provide facts. - Resolve conflicts clause-by-clause, favoring the more protective standard, and preserve a short drafting rationale for each material choice in the cover memo. - Check consistency between the agreement and the commercial master document so the DPA supplements, rather than contradicts, the broader service arrangement. - Keep the memo decision-focused: what was chosen, why it was chosen, what remains open, and who must decide. ## 5. Vertical / structural / temporal relationships - Role allocation in the service materials drives the Article 28 structure; if roles shift, the contract architecture must shift with them. - Risk assessment findings generate mitigation commitments; those commitments should appear as binding clauses, annex entries, or conditions precedent. - Transfer conclusions constrain drafting options; any clause on onward transfer, subprocessing, or audit must be consistent with the transfer mechanism and supplementary measures. - Commercial terms in the master agreement set the outer frame; the DPA should be supplemental and consistent, not duplicative or contradictory. ## 6. Output structure conventions - Produce the execution-ready DPA first, then the client cover memo. - The DPA should use conventional legal architecture: parties, recitals, defined terms, processing terms, confidentiality and security, assistance, subprocessors, breach notification, audits, return/deletion, cross-border transfer terms if applicable, and annexes with factual schedules. - Annexes should carry the engagement-specific facts: controller/processor identities, processing description, categories of data subjects and data, jurisdictions, security measures, and approved subprocessors or approval mechanics. - Use the more protective drafting where source documents conflict, and reflect the resolution in the memo. - The cover memo should briefly explain key drafting decisions, identify open items needing client instruction, and note any assumptions made because the source set was incomplete. - The memo should also identify any transfer or security conditions that must be confirmed before signature. - Deliver the documents in the filenames exactly requested, with the agreement as the primary deliverable and the memo as the secondary deliverable.