Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

DPA Art. 28 GDPR — Review, Drafting & Redlining · lawve-ai | DecimalAI

legalby lawve-ai

DPA Art. 28 GDPR — Review, Drafting & Redlining

lawve-ai/dpa-art-28-oliver-schmidt-prietz

Source lawve-ai/awesome-legal-skills ↗License NOASSERTION

Review, draft, or redline a Data Processing Agreement (DPA / Auftragsverarbeitungsvertrag / AVV) under Art. 28 GDPR, or prepare a Joint Controller Arrangement under Art. 26 GDPR. Supports bilingual output (DE/EN), both controller- and processor-side perspectives, and two review depths — quick (Art. 28(3)(a)–(h) coverage) and negotiation-grade (clause-by-clause risk scoring).

SkillScore68Maintained

Automatic

Legal & Contracts pack

Last verified 8/16/2026

What it changes

Passed 15 of 22 test cases with the skill, and 9 of 22 without it.

Without skill41%

With skill68%

Checks it passed that the model alone missed

Formats additions in bold font and deletions in strikethrough font.
Includes a practitioner's note at the end detailing practical next steps.
Appends a practitioner's note at the end outlining next operational steps.

and 3 more in the full report

6 fixed9 passed either way7 still failing0 broke

Pass-rate lift: +27 pp
Tokens: +91%
Agent turns: 0%
Response time: -7%

Model gemini-3.6-flashMeasured 8/16/2026v115 of 22 cases passed with skill

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/lawve-ai-dpa-art-28-oliver-schmidt-prietz/SKILL.md https://app.decimal.ai/s/lawve-ai-dpa-art-28-oliver-schmidt-prietz/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add lawve-ai-dpa-art-28-oliver-schmidt-prietz, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/lawve-ai-dpa-art-28-oliver-schmidt-prietz/ and pins it in .decimal/skills.lock

decimalai skills add lawve-ai-dpa-art-28-oliver-schmidt-prietz

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/lawve-ai-dpa-art-28-oliver-schmidt-prietz/SKILL.md https://app.decimal.ai/s/lawve-ai-dpa-art-28-oliver-schmidt-prietz/SKILL.md

Raw file: /s/lawve-ai-dpa-art-28-oliver-schmidt-prietz/SKILL.md ↗ · machine-readable summary at /s/lawve-ai-dpa-art-28-oliver-schmidt-prietz.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 6

Prompt

We received a counterparty DPA draft and need to produce a marked-up redline. What exact formatting convention must be used for additions and deletions, and how must clause numbering be handled relative to the counterparty draft?

What was checked, without and with the skill
Checked	Without skill	With skill
Formats additions in bold font and deletions in strikethrough font.	Missed	Passed
Retains the counterparty draft's exact clause numbering scheme for traceability.	Passed	Passed

case-22 · gemini-3.6-flash · 8/16/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md151 lines17 files

DPA Art. 28 GDPR — Review, Drafting & Redlining

Purpose

This skill governs all work on controller–processor contracts (Art. 28 GDPR) and joint-controller arrangements (Art. 26 GDPR). It produces:

Reviews of existing DPAs (quick or negotiation-grade)
Drafts of new DPAs / AVVs from modular templates (DE / EN)
Redlines in response to counterparty drafts
Joint Controller Agreements (JCA / Art.-26-Vereinbarung)

Mode router — ALWAYS run first

Before doing anything else, classify the request into ONE of these modes:

Mode	Trigger pattern	Workflow file
`REVIEW_QUICK`	"Is this DPA compliant?", "Art. 28(3)(a)–(h) check", short turnaround, sign/no-sign decision needed	`workflows/review-quick.md`
`REVIEW_NEG`	"Review this for negotiation", "give me redline points", "what should we push back on", deeper diligence	`workflows/review-negotiation.md`
`DRAFT`	"Draft a DPA", "create an AVV", "we need a processor agreement for [X]", greenfield	`workflows/draft.md`
`REDLINE`	Counterparty has sent a DPA, user wants tracked-changes / counter-proposals	`workflows/redline.md`
`JOINT_CONTROLLER`	"Art. 26", "joint controller", "JCA", or roles screen reveals JC not processor relationship	`workflows/joint-controller.md`

If unclear, ASK. Do not guess between REVIEW_QUICK and REVIEW_NEG — the depth difference is ~30 min vs ~2–3 h of analytical work, and the output structure is materially different.

Mode flips during the work are allowed and expected. If a REVIEW_QUICK reveals issues serious enough that the user needs negotiation guidance, surface this and offer to escalate to REVIEW_NEG. If a roles screen during DRAFT or REVIEW_* reveals the parties are actually joint controllers, stop and switch to JOINT_CONTROLLER.

Intake — ALWAYS gather these before producing output

Regardless of mode:

Roles — Who is controller, who is processor? Confirm explicitly. If both parties might be controllers, run the Art. 26 vs Art. 28 screen in references/art26-joint-controller.md BEFORE proceeding.
Perspective — Which side does the user represent? (controller-favorable / processor-favorable / balanced)
Language — DE / EN / bilingual? Default: match the language of the source document; if drafting from scratch, ASK.
Tier (DRAFT and REDLINE modes) — Tier 1 Commercial / Tier 2 Strict (2021/915 incorporated unmodified) / Tier 3 Hybrid (Sections I+II of 2021/915 + custom Section III). Load references/tier-selection.md and walk the decision tree if the user has not pre-selected. For REVIEW modes, the tier is whatever the source document is — identify it and continue.
Processing scenario — Concrete description: subject matter, nature, purpose, data categories, data subjects, duration. Without this, drafting is impossible and review is shallow. If missing, REQUEST it before proceeding.
International transfers — Will personal data be transferred outside the EEA, or accessed from outside the EEA? If yes, load references/sccs-module-guide.md and flag SCC requirements early. Note: 2021/915 (Tiers 2/3) does not by itself cover transfers — pair with 2021/914 if needed.
Sub-processors — General authorization, specific authorization, or none? This affects clause structure and risk profile. For Tiers 2/3, this maps to Clause 7.7 Option 1/2 of the SCCs.
Special categories / Art. 9 / Art. 10 data — If yes, enhanced TOMs and stricter purpose limitation needed; flag at intake.

Track record

Benchmark

15 / 22

test cases passed, vs 9 / 22 without

Adoption

Users: 0
Times used: 0

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

lawve-ai / awesome-legal-skills

skills/data-processing-agreement-art-28-gdpr-oliver-schmidt-prietz/SKILL.md

View on GitHub ↗

License NOASSERTIONImported 8/3/2026Version v1Bundled 16 files

Other skills for the same job

Published skills whose descriptions closely match this one, with their headline benchmark lift.

More skills from the same source and nearby in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

See it in action

What's inside

DPA Art. 28 GDPR — Review, Drafting & Redlining

Purpose

Mode router — ALWAYS run first

Intake — ALWAYS gather these before producing output

Track record

Benchmark

Adoption

SkillSafety

Source

Other skills for the same job

Related skills