# DPA draft with subprocessors (/legal--dpa-gen)

/legal--dpa-gen is a Claude Code skill in the Business section. Drafts a Data Processing Agreement with the subprocessor list and annexes built from the stack your code actually uses.

- Web version: https://skills.sgomez.dev/en/s/legal--dpa-gen
- Section: [Business](https://skills.sgomez.dev/en/business.md)
- Author: Santiago Gómez de la Torre
- License: MIT
- Source: https://github.com/sgomez-dev/claude-skills/blob/main/skills/legal/dpa-gen.md
- Updated 10 Jul 2026

## Use it when

- You sell a SaaS and a customer asks you to sign a DPA
- You need to list the subprocessors you really use
- You want data and security annexes grounded in your code

## Not for

- Replacing the advice of a lawyer
- Reviewing a vendor DPA: contract review is the better fit

## What you get

A legal/DPA_DRAFT.md file following the GDPR Art. 28 structure, with processing, security and subprocessor annexes, plus a gap list in the chat.

## How to ask for it

- `/legal--dpa-gen draft a DPA for my SaaS with my current subprocessors`
- `/legal--dpa-gen I need the data processing agreement based on my real stack`
- `/legal--dpa-gen generate the subprocessor list and base DPA`

## Install

macOS · Linux:

```
curl -fsSL https://raw.githubusercontent.com/sgomez-dev/claude-skills/main/install.sh | bash
```

Windows:

```
irm https://raw.githubusercontent.com/sgomez-dev/claude-skills/main/install.ps1 | iex
```

Claude Code plugin:

```
/plugin marketplace add sgomez-dev/claude-skills
/plugin install legal-skills@claude-skills-collection
```

## Permissions

- Reads: `**/*`
- Writes: `legal/**`, `DPA*.md`
- Runs: —
- Network: No
- Destructive: No

## Author's description

Draft a DPA skeleton with a subprocessor list built from your actual stack

## Questions about this skill

### How does it know which subprocessors I use?

It infers them from dependencies, SDKs, env vars and infrastructure files. It keeps only services that receive personal data, and marks region [CONFIRM] when the code does not reveal it.

### Does it work if I am the controller, not the processor?

It asks your role, since obligations flip. To review a vendor DPA it suggests the contract review skill instead.

### Is the result ready to sign?

No. It is a skeleton with [PLACEHOLDER] markers for anything unverifiable and needs legal review.


- [How we review this](https://skills.sgomez.dev/en/methodology.md)