Supplier DPA GDPR Analysis

What this skill does

Systematic analysis of a Data Processing Agreement (DPA) in light of Article 28 of the GDPR, EDPB Guidelines 07/2020 and 02/2024, the 2021 Standard Contractual Clauses, and Regulation (EU) 2024/1689. Generates a structured, clause-by-clause report based on 18 criteria (13 mandatory + 5 supplementary) with a 🟢/ 🟡/🔴, a detailed analysis of international transfers (structured table + government access under the Cloud Act/FISA 702), verification of AI system usage, ready-to-insert contractual remedies, and questions to ask the provider. Designed for DPOs and GDPR practitioners who negotiate or audit data processing agreements.

• Supplier
• Gdpr
• Analysis

Where it runs, and how to install it

Agent Skills are a format, not a product feature: a folder with a SKILL.md and whatever files it needs. Nothing inside one is model-specific.

Claude

Drop the skill folder into ~/.claude/skills/, or upload it in Settings → Capabilities. Claude loads it when the description matches what you asked for.

Claude Code

Same folder, per-project instead: .claude/skills/ inside the repository, so the skill travels with the work rather than with the machine.

Any agent that reads SKILL.md

A skill is a folder with a SKILL.md and whatever files it needs. Nothing in the format is model-specific, so a runtime that reads the file reads the skill.

More from Hugo Salard

• Website GDPR Compliance AuditGDPR compliance audit of a website by a GDPR practitioner/DPO. Systematic assessment using a 10-section checklist: legal notice, hosting provider, forms, newsletter, privacy policy, cookies, passwords, trackers, processors and transfers outside the EU, and accessibility of data subject rights, plus a 22-item appendix covering Articles 13/14 GDPR. Produces a structured report (Markdown, optional .docx) with an overall compliance level, blocking issues, points requiring attention, priority recommendations, and cited regulatory sources (LCEN, GDPR, ePrivacy, CNIL decisions, EDPB, DPF). Tool-agnostic: automated browsing or fallback copy-paste mode. 7 decision trees for edge cases. The practitioner validates all statuses before the report is sent to the client. Technical analysis only, no legal advice.

Skills that do related work

• DPIA SentinelGDPR Data Protection Impact Assessment (DPIA) guidance under Article 35 GDPR, EDPB Guidelines WP 248 rev.01, EDPB Opinion 28/2024 (AI), and national SA blacklis
• GDPR Breach SentinelIncident response and legal compliance guidance for data breaches under GDPR Articles 33 & 34. Covers breach risk assessment using ENISA severity methodology, C
• Cold Email Compliance GateAudit cold email campaigns against CAN-SPAM, CASL, PECR and GDPR using primary statutory requirements.
• DPDPA & GDPR Compliance ReviewPerforms structured compliance review, clause redlining, and drafting suggestions for legal documents (privacy policies, data processing agreements, vendor and
• EU compliance toolAll-in-one EU compliance assistant: AI Act classification, GDPR audit, cross-border legal structuring and EU grant/subsidy scanning, one skill for founders and
• EU GDPR Digital Compliance OfficerRuns a GDPR compliance review, lawful basis assessment, data inventory, privacy policy check, cookie consent, right-to-erasure workflow, for the website or code