What do I need to use DPA Review?

The DPA text; Your role; The data; Deal context.

Is DPA Review free to use?

Yes — run it free in the browser playground (no API key needed for the sponsored trial, or bring any provider key), or install it into Claude Code, Cursor, ChatGPT and more via npx pm-claude-skills. MIT-licensed and open source.

DPA Review

Q: How do I know the DPA Review output is good?

The skill verifies itself against its own quality checks: Controller/processor role identified — findings framed from your side; Sub-processor, transfer, breach-window, and deletion terms each assessed (or flagged absent); The breach-notification window is stated in hours/days, not left as "reasonable"; Every 🔴 names the exact clause and the concrete exposure.

🔵 Stable 🔷 SkillSpec L3 pm-legal

Read a Data Processing Agreement before you sign it — sub-processors, transfer mechanism, breach-notice window, deletion, audit rights — in plain language with 🔴🟡🟢 risk. Use when asked to review a DPA, check a data processing agreement, is this DPA safe to sign, or what am I agreeing to on data. Produces the plain-English summary, the risk-ranked findings, the missing-clause checklist, and the questions to send back before signature.

▶ Run it free — no key needed 📝 Grade your existing draft View SKILL.md ↗

🗣 Say this to your agent

“Review this DPA before we sign the vendor contract.”“Is this data processing agreement safe to sign?”“What am I agreeing to on data in this DPA?”“Check this DPA — we're the controller, it's a GDPR deal.”

What to give it

▸The DPA text — the document, or its key clauses pasted

▸Your role — are you the controller (your data) or the processor (you're the vendor)? The risks flip

▸The data — what personal/sensitive data is involved, and any regime that applies (GDPR, CCPA, HIPAA)

▸Deal context — how critical the vendor is; leverage shapes what's worth fighting

✅ The bar it holds itself to

Every skill in this library self-verifies — these are this skill's own quality checks, straight from its definition.

✓Controller/processor role identified — findings framed from your side

✓Sub-processor, transfer, breach-window, and deletion terms each assessed (or flagged absent)

✓The breach-notification window is stated in hours/days, not left as "reasonable"

✓Every 🔴 names the exact clause and the concrete exposure

✓Missing-clause list distinguishes "unusual gap" from "standard omission"

✓Flagged for counsel review on anything material

⚠️ What it refuses to do

**Summarising without ranking** — a wall of clauses helps no one; rank by damage.

**Ignoring who you are** — a processor and a controller face opposite risks in the same document.

**Treating "reasonable security" as fine** — undefined standards are the finding.

**Inventing a clause number** or requirement not in the text — quote what's there.

Install

npx pm-claude-skills add --agent claude   # or codex · cursor · gemini · hermes
# or one-line MCP (every skill, any client):
claude mcp add pm-skills -- npx -y pm-claude-skills-mcp

Start with

Related skills

🔌 Embed this skill

Drop this on your blog, docs, or site — it renders a "Run this skill" card:

<div data-pm-skill="dpa-review"></div>
<script src="https://mohitagw15856.github.io/pm-claude-skills/embed.js" async></script>

💬 Discussion

DPA Review is one of 832 open-source professional AI agent skills — all SkillSpec L3. Try them all in the browser · ⭐ Star on GitHub · Browse the full catalog