Every SaaS contract now drags a Data Processing Agreement behind it, and most get signed unread — which is how you inherit a vendor's sub-processors, a 30-day breach-notice window, and no deletion guarantee. This reads the DPA the way a privacy counsel skims it: what data is processed, who else touches it, where it goes, what happens on a breach, and what's missing — ranked by how much it can hurt.
Not legal advice. Flags issues for review; have privacy counsel sign off on a material agreement.
What This Skill Produces
- The plain-English summary — what this DPA actually commits each side to
- Risk-ranked findings — 🔴 sign-blockers, 🟡 negotiate, 🟢 standard — each with the clause and why it matters
- The missing-clause checklist — the protections a good DPA has that this one lacks
- The redline questions — what to send back to the vendor before signing
Required Inputs
Ask for these if not provided:
- The DPA text — the document, or its key clauses pasted
- Your role — are you the controller (your data) or the processor (you're the vendor)? The risks flip
- The data — what personal/sensitive data is involved, and any regime that applies (GDPR, CCPA, HIPAA)
- Deal context — how critical the vendor is; leverage shapes what's worth fighting
Framework: What a DPA Must Get Right
- Scope & roles — controller vs processor, and the processing purpose; a mismatch here voids the rest.
- Sub-processors — who else gets the data, notice of new ones, and a right to object.
- International transfers — the mechanism (SCCs, adequacy, DPF) for data leaving its region.
- Security & breach — the standard, and the breach-notification window (72 hours is the GDPR bar; "reasonable" is a red flag).
- Deletion & return — what happens to your data at termination, and by when.
- Audit & liability — your right to verify, and whether liability is capped below the data risk.
Output Format
DPA Review — [vendor] · you are the [controller/processor]
Verdict: Safe to sign / Negotiate first / Do not sign — one line why
Risk-ranked findings
| Risk | Clause | What it says | Why it matters |
|---|---|---|---|
| 🔴 | … | … | … |
Missing protections
- [clause a good DPA has that this lacks]
Send back before signing
- [redline question / requested change]
Quality Checks
- Controller/processor role identified — findings framed from your side
- Sub-processor, transfer, breach-window, and deletion terms each assessed (or flagged absent)
- The breach-notification window is stated in hours/days, not left as "reasonable"
- Every 🔴 names the exact clause and the concrete exposure
- Missing-clause list distinguishes "unusual gap" from "standard omission"
- Flagged for counsel review on anything material
Anti-Patterns
- Summarising without ranking — a wall of clauses helps no one; rank by damage.
- Ignoring who you are — a processor and a controller face opposite risks in the same document.
- Treating "reasonable security" as fine — undefined standards are the finding.
- Inventing a clause number or requirement not in the text — quote what's there.
Example Trigger Phrases
- "Review this DPA before we sign the vendor contract."
- "Is this data processing agreement safe to sign?"
- "What am I agreeing to on data in this DPA?"
- "Check this DPA — we're the controller, it's a GDPR deal."