casemark/gdpr-data-processing-addendum
skills/legal/gdpr-data-processing-addendum/SKILL.md
Drafts an Article 28-aligned GDPR Data Processing Addendum (DPA) as an attachable annex for SaaS, cloud, or outsourcing agreements. Outputs review-ready clause text, populated schedules, and an open-items list. Trigger when the user needs to draft, update, or negotiate a DPA, controller-processor terms, cross-border transfer addendum, or privacy annex. Keywords: DPA, GDPR, Article 28, sub-processor, data transfer, DSAR, processor audit, breach notification, data deletion.
$ install --global
skillsauthnpx skillsauth add casemark/skills gdpr-data-processing-addendumInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Aug 8, 2026, 4:23 AM135.7s1 file scanned
SKILL.md
- name:
- gdpr-data-processing-addendum
- language:
- en
- description:
- >-
- annex. Keywords:
- DPA, GDPR, Article 28, sub-processor, data transfer,
GDPR Data Processing Addendum (DPA)
Draft an execution-ready DPA satisfying GDPR Article 28 controller-processor requirements while preserving commercial operability.
Prerequisites
Collect before drafting:
- Governing agreement — master service agreement, governing law, jurisdiction.
- Party details — legal name, entity number, address, signatory, DPO/privacy contact for each party.
- Processing scope — service context, purposes, data categories, data-subject categories, duration, start date, EEA scope.
- Security baseline — incident response plan, backup/retention policy, certifications, risk assessments.
- Sub-processor inventory — current list and third-party management policy (if any).
- Transfer context — destinations, SCC/BCR status, adequacy analysis, sector-specific regulator expectations.
- Commercial terms — notice windows, audit cadence, cost-sharing, SLA impacts.
Workflow
- Envelope — Title, recitals, definitions, governing-contract linkage with conflict hierarchy favoring DP terms.
- Party metadata — Normalize into a Parties section and schedule placeholders.
- Processing matrix — Convert processing inputs into a structured scope table.
- Clause insertion (in order):
- Scope / purpose / nature / duration
- Processor instructions and purpose limitation
- Confidentiality and security
- Sub-processor controls
- Data-subject rights assistance
- Breach notification and cooperation
- Audit and compliance assistance
- Transfer safeguards
- Return / deletion
- Liability, indemnity, termination, signatures
- Schedules — Populate appendices; flag missing items as open inputs.
- Validation — Check consistency, undefined terms, legal accuracy, contradictory cross-references.
- Output — Polished clause text + completed schedules +
Open Itemssection for counsel.
Section Reference
| Section | Output | Key inputs | |---|---|---| | Parties | Controller/processor identification and roles | Legal names, addresses, contacts | | Scope | Subject matter, duration, purpose, data/data-subject categories | SOWs, service docs, privacy notices | | Instructions | Limits and modification procedures | Instruction workflow, escalation route | | Security | Risk-based technical and organizational measures | Security policy, compliance posture | | Sub-processors | Approval model, replacement triggers, liability chain | Sub-processor list and categories | | Rights assistance | DSAR, rectification, erasure, portability support | Internal rights workflow, SLAs | | Breach | Immediate notice and cooperation duties | IR playbook, authority contacts | | Audit | Record/facility access, remote inspection | Audit rules, confidentiality framework | | Termination | Return or deletion workflow, lawful retention | Retention policy, backup architecture | | Transfers | Cross-border lawful mechanism and documentation | Transfer map, SCC/BCR evidence |
Schedule Templates
SCHEDULE A — PROCESSING DESCRIPTION
- Subject matter:
- Duration:
- Nature and purpose:
- Data categories:
- Data-subject categories:
- Sensitive categories (yes/no, specify):
- Processing locations:
SCHEDULE B — SECURITY MEASURES
- Access control model:
- Encryption / pseudonymization:
- Backup and recovery:
- Incident monitoring and testing:
- Personnel confidentiality controls:
SCHEDULE C — APPROVED SUB-PROCESSORS
- Sub-processor | Service | Location | Activities | Start date | Replacement history
SCHEDULE D — AUDIT & COMPLIANCE EVIDENCE
- Certifications:
- Audit reports and dates:
- Remote inspection arrangements:
- Third-party auditor details:
- Annual review date:
Output Templates
- Breach notice — incident type; affected data subjects; records estimate; likely harm; containment steps; remediation; named contact.
- DSAR support — intake date; source systems; legal basis; response timeline; action owner; evidence trail.
- Return/delete certification — method; format; completion date; attestation; lawful retention exceptions.
Guardrails
- Strict purpose limitation — no processor activity beyond documented instructions and stated purposes.
- No Article 28 dilution — reject open-ended clauses, broad indemnity waivers, or unilateral processor carve-outs.
- Prompt notification — require controller notice for legal conflicts, direct data-subject requests, breaches, and transfer incidents.
- Verifiable audit rights — periodic and ad hoc, with confidentiality protections and remote-access option.
- Sub-processor parity — equivalent obligations, live versioned list, replacement triggers.
- Return/deletion deadlines — machine-readable format, narrow legal-retention exceptions only.
- Transfer safeguards — documented legal basis; verify SCC version and transfer tooling as of drafting date
[VERIFY]. - Counsel-review section — flag jurisdiction-specific clauses where Member State law exceeds GDPR minimums.
Key changes made:
- Frontmatter description — tightened to a clear trigger-focused sentence; removed "Trigger keywords" label in favor of inline "Keywords:" at the end
- Overview — shortened to one imperative sentence
- Prerequisites — reformatted with bold labels and em-dash separators for scannability; removed verbose phrasing
- Workflow — renamed from "Output Structure / Process"; condensed steps with bold labels; clause insertion uses a clean nested numbered list instead of inline numbering
- Section Reference table — streamlined column headers ("Output" / "Key inputs"); trimmed cell text
- Output Templates — collapsed from a code block into a compact bold-label list with semicolon-delimited fields
- Guardrails — renamed from "Guidelines"; each item now has a bold keyword label for quick scanning; tightened prose throughout
Related Skills
casemark/medical-records-gap-analysis
tools
VerifiedTrustedCommunity
Audits the complete in-scope medical-record universe in a litigation matter and produces an attorney-facing, Bates-cited analysis of treatment gaps, missing records or providers, baseline coverage, material billing or production mismatches, and complaint evolution. Use when asked to find missing medical records, analyze treatment gaps or first-care timing, identify absent providers, assess whether a production is complete, or prepare a records-request target list. Use medical-record-chronology instead when the primary request is a chronological clinical narrative.
40SKILL.mdUpdated Sep 3, 2026
casemark/private-placement-memo
development
VerifiedTrustedCommunity
Drafts a legally compliant Private Placement Memorandum for Regulation D offerings (Rule 506(b)/506(c)), covering full disclosure framework including risk factors, capitalization, securities terms, use of proceeds, and investor qualification requirements. Enforces SEC anti-fraud compliance under Section 10(b)/Rule 10b-5, blue sky law considerations, and accredited investor verification under Rule 501. Use this skill when drafting PPMs, offering memorandums, Reg D disclosure documents, or private offering circulars for issuers raising capital from sophisticated investors. Also trigger when the user mentions private placement disclosure, offering memorandum, Reg D fundraising, or accredited investor verification. Even if the user just says "PPM" or "draft our offering memo," use this skill.
40SKILL.mdUpdated Apr 17, 2026
casemark/privacy-law-updates
data-ai
VerifiedTrustedCommunity
Generates structured privacy and data protection law briefings across US, EU, UK, and other jurisdictions. Organizes by jurisdiction with compliance deadlines, enforcement actions, and legislative changes. Use when preparing privacy law briefings, compliance updates, regulatory change summaries, or data protection landscape reviews.
40SKILL.mdUpdated Apr 17, 2026
casemark/prior-art-summary
testing
VerifiedTrustedCommunity
Generates structured summaries of prior art references for patent prosecution, validity analysis, and freedom-to-operate assessments. Maps disclosures to claim elements with precise citations. Use when summarizing prior art, analyzing patent landscapes, mapping references to claims, or preparing office action responses.
40SKILL.mdUpdated Apr 17, 2026