# Data processing agreement drafter
> Source: https://legalcode.md/skills/legalcode-data-processing-agreement-drafter | [HTML version](https://legalcode.md/skills/legalcode-data-processing-agreement-drafter)

Draft Data Processing Agreements (DPAs) from scratch for controller-to-processor, controller-to-controller (joint), and processor-to-sub-processor relationships.

Draft Data Processing Agreements (DPAs) from scratch for controller-to-processor, controller-to-controller (joint), and processor-to-sub-processor relationships. Produces GDPR Article 28-compliant, UK GDPR, CCPA/CPRA service provider, Brazil LGPD, and India DPDP Act-aligned DPA clauses and full agreements with jurisdiction-specific annexes. Covers subject matter and duration, processing instructions and scope limitations, data categories and data subject types, controller/processor obligations, sub-processor management and notification mechanisms, technical and organizational security measures (TOMs), data breach notification SLAs, data subject rights assistance, DPIA and prior consultation support, international data transfer mechanisms (EU SCCs 2021, UK IDTA, adequacy decisions, BCRs), audit and inspection rights, data return and deletion on termination, and liability allocation. Includes EU, UK, Brazil LGPD, and India DPDP annexes. Use when creating a new DPA from scratch, generating a DPA template for a vendor program, building sub-processor flow-down agreements, adding a DPA addendum to a master services agreement, drafting multi-jurisdiction DPAs for SaaS platforms, or designing a DPA program across multiple processing relationships and regimes. Supports both controller-side and processor-side drafting with dual-perspective clause options and negotiation guidance. Jurisdiction-agnostic baseline with multi-regime modular annexes.

This skill drafts Data Processing Agreements and data processing addenda from scratch or by adapting existing templates. It covers all mandatory GDPR Article 28 clause categories, generates jurisdiction-specific annexes for UK, California, Brazil, and India, and produces dual-perspective clause language for both controller-side and processor-side drafting. **Covers:** - Drafting complete DPAs from scratch for any controller/processor relationship - Adapting or supplementing existing DPA templates to meet current regulatory requirements - Controller-to-processor DPAs (GDPR Art. 28 / UK GDPR / CCPA service provider / LGPD operator) - Controller-to-controller arrangements (GDPR Art. 26 joint controller agreements) - Processor-to-sub-processor flow-down DPAs (cascading obligations downstream) - Multi-regime modular output: GDPR base DPA + UK Addendum + California Exhibit + Brazil Annex + India Annex - Technical and Organizational Measures (TOM) specification in Annex form - Sub-processor authorization frameworks (specific and general authorization mechanisms) - International transfer mechanism selection and clause generation (EU SCCs 2021, UK IDTA, adequacy, BCRs) - Dual-perspective drafting: controller-favorable, processor-favorable, and market-standard compromise positions - Quality-verified output with Glass Box audit trail and confidence scoring **Does not:** - Review or negotiate existing DPAs (see `legalcode-dpa-review-and-negotiation`) - Provide legal advice or replace qualified DPO or counsel review - Cover all global privacy ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*