Review a data processing agreement against GDPR Article 28
Checks a vendor DPA for the mandatory processor terms, transfer safeguards, and security commitments, and suggests redlines for gaps.
The prompt
Review this data processing agreement (DPA) against GDPR Article 28 and common good practice.
DPA text: [PASTE]
Main agreement context: [service provided, vendor name, our role: controller / processor]
Personal data and data subjects involved: [e.g. "customer names, emails, payment data"]
Special category or high-risk data? [yes/no - details]
Where the vendor and its sub-processors process data: [COUNTRIES]
Other laws in scope: [e.g. UK GDPR, CCPA/CPRA, other local laws]
Check for each Article 28(3) element and mark Present / Weak / Missing, with the section number:
- Processing only on documented instructions, including for transfers
- Confidentiality of personnel
- Security measures (Article 32) - are the technical and organizational measures specific or vague?
- Sub-processor conditions: prior authorization, notice of changes, right to object, flow-down, liability for sub-processors
- Assistance with data subject rights
- Assistance with security, breach notification (timing in hours), DPIAs, and prior consultation
- Deletion or return at end of services
- Information and audit rights
- Duty to tell us if an instruction infringes data protection law
Also check: description of processing (subject matter, duration, nature, purpose, data types, data subjects); international transfer mechanism (e.g. SCCs, adequacy) and transfer risk assessment; liability caps that undercut the DPA; conflicts with the main agreement.
Return: the checklist table, then suggested redline language for each gap, then a short summary for the business owner. This is a review aid; a qualified privacy lawyer must confirm before signing.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Legal & Compliance prompts
What to fill in
- PASTE
- e.g. "customer names, emails, payment data"
- yes/no - details
- COUNTRIES
- e.g. UK GDPR, CCPA/CPRA, other local laws
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Check my AI workflow for privacy and data-protection risksMaps the personal and confidential data in an AI-assisted process and flags privacy and compliance risks to fix before launch.
- Write a suspicious activity report (SAR) narrativeA clear, chronological SAR narrative that answers who, what, when, where, why, and how, ready for compliance review.
- Assess subrecipient risk and plan grant monitoringA risk assessment and monitoring plan for organizations you pass grant funds to, scaled to their risk and aligned to your award terms.
- Run a HIPAA security risk assessment for a small practiceA structured security risk analysis covering where ePHI lives, threats, likelihood and impact ratings, and a documented remediation plan.