DPA Review

Every SaaS contract now drags a Data Processing Agreement behind it, and most get signed unread — which is how you inherit a vendor's sub-processors, a 30-day breach-notice window, and no deletion guarantee. This reads the DPA the way a privacy counsel skims it: what data is processed, who else touches it, where it goes, what happens on a breach, and what's missing — ranked by how much it can hurt.

Not legal advice. Flags issues for review; have privacy counsel sign off on a material agreement.

What This Skill Produces

• The plain-English summary — what this DPA actually commits each side to
• Risk-ranked findings — 🔴 sign-blockers, 🟡 negotiate, 🟢 standard — each with the clause and why it matters
• The missing-clause checklist — the protections a good DPA has that this one lacks
• The redline questions — what to send back to the vendor before signing

Required Inputs