# DPA review and negotiation
> Source: https://legalcode.md/skills/legalcode-dpa-review-and-negotiation | [HTML version](https://legalcode.md/skills/legalcode-dpa-review-and-negotiation)

Review and negotiate Data Processing Agreements (DPAs) clause-by-clause against GDPR Article 28 mandatory requirements, UK GDPR equivalents, CCPA/CPRA service provider contract provisions, and LGPD operator obligations.

Review and negotiate Data Processing Agreements (DPAs) clause-by-clause against GDPR Article 28 mandatory requirements, UK GDPR equivalents, CCPA/CPRA service provider contract provisions, and LGPD operator obligations. Covers subject matter and duration, nature and purpose of processing, data categories and data subject types, controller instructions mechanism, confidentiality of personnel, sub-processor controls (specific and general authorization), security obligations (Art. 32 / technical and organizational measures), data subject rights assistance, DPIA and prior-consultation support, breach notification requirements, audit rights, data return and deletion on termination, and international transfer mechanisms (EU SCCs, UK IDTA, adequacy decisions). GREEN/YELLOW/RED classification with confidence scores, redline suggestions, fallback positions, and negotiation priority tiers. Use when reviewing a DPA or data processing addendum from a vendor, SaaS provider, or sub-processor; when drafting or negotiating DPA terms as a controller, processor, or sub-processor; when auditing existing DPAs for compliance gaps; or when building a DPA review program across multiple regimes.

This skill reviews existing Data Processing Agreements and data processing addenda against the mandatory requirements of GDPR Article 28, UK GDPR, CCPA/CPRA service provider contract provisions, and LGPD operator obligations. It identifies compliance gaps, classifies their severity, generates actionable redline suggestions with fallback positions, and produces a confidence-scored, auditable analysis. **Covers:** - Clause-by-clause analysis of any DPA or data processing addendum - Role classification verification (controller/processor/sub-processor determination) - Compliance gap classification (GREEN / YELLOW / RED) - Redline generation with fallback positions for each gap - Multi-regime coverage: EU GDPR, UK GDPR, CCPA/CPRA, and LGPD (Brazil) - International transfer mechanism review (EU SCCs, UK IDTA, adequacy decisions, BCRs) - Missing clause detection (items required by statute but absent from the DPA) - Negotiation priority framework for controllers and processors - Quality-verified output with Glass Box audit trail **Does not:** - Draft new DPAs from scratch (see `gdpr-data-processing-addendum` for EU drafting) - Provide legal advice or replace qualified DPO or counsel review - Cover all global privacy regimes — focused on EU/UK/US(CA)/BR; see jurisdiction-specific skills for other regimes (PDPA Singapore, APPI Japan, Australia Privacy Act, etc.) - Guarantee regulatory approval or exemption from enforcement - Assess breach notification obligations (see `legalcode-breach-severity-assessment`) ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*