Guide · Agent skill
How to use the DPA Review agent skill (dpa-review)
Updated · written with AI from the project's own documentation and checked against our catalogue data
dpa-review is an agent skill that reviews a Data Processing Agreement (DPA), the contract that governs how a vendor or customer handles personal data. It checks the DPA term by term against a DPA playbook you have saved, and it checks the DPA against your privacy policy. This guide explains what the skill does, how to install it, how to ask for a review, and what it needs before it runs.
DPA Reviewanthropics/claude-for-legal · Apache-2.0 Download the skill Quick start
- 1Confirm the requirements. Check that the Claude for Legal plugin is set up and that the privacy-legal configuration file exists at the path the skill expects. Make sure it contains a DPA playbook with real content.
- 2Install the skill. Download the dpa-review ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into .claude/skills/ in a project. In the Claude apps, upload the ZIP under Settings, then Capabilities, then Skills.
- 3Provide the DPA. Attach the DPA as a file, share a Drive link, or paste the text into the chat.
- 4Ask for the review. Use a natural request such as 'review this DPA' or 'is this DPA okay'. If the agent asks whether your company is the processor or the controller, answer that question directly.
- 5Read the review memo. Open the memo with its suggested redlines in your outputs folder. Check the prior-work notes and the federal sectoral overlay section.
- 6Have a lawyer check it. Treat the memo as a first-pass review. A qualified lawyer should confirm jurisdiction and sector assumptions before any sign-off.
What the dpa-review skill makes the agent do
An agent skill is a set of instructions that Claude follows when a request matches the skill's purpose. The dpa-review skill tells the agent how to review a DPA. It first works out whether your company is the processor or the controller, because the review reads from a different part of the playbook for each role. If the direction is unclear, the agent asks you.
The agent then checks each clause against the matching row of your DPA playbook. It also runs a privacy policy consistency check, since the DPA should not contradict what your privacy policy promises. For data in federally regulated categories, the skill flags sector rules such as HIPAA, GLBA, FERPA or COPPA when they are relevant.
- Determines processor or controller role before reviewing
- Checks each clause against the saved DPA playbook for that role
- Checks the DPA against your privacy policy
- Flags federal sector rules such as HIPAA, GLBA, FERPA or COPPA when relevant
- Produces a review memo with suggested redlines, saved to your outputs folder
Set up the DPA playbook before you install
The skill reads its playbook from a configuration file. It expects a privacy-legal configuration file at ~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md that contains a DPA playbook. The skill also reads a privacy policy commitments section from the same file. If the playbook still has placeholders, the skill stops and prompts you to complete setup.
The skill is part of the Claude for Legal plugin setup, so the plugin and its configuration file need to be in place. Without a configured playbook, the skill adds little value, because it has no standard to check the DPA against.
- Path: ~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md
- Must contain a DPA playbook with real content, not placeholders
- Should contain privacy policy commitments, which the review checks the DPA against
~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.mdInstall the dpa-review skill
Download the dpa-review ZIP from this page. Then choose one of two install routes. For a personal setup, unzip it into ~/.claude/skills/. To share it with one project, unzip it into the .claude/skills/ folder inside that project.
If you use the Claude apps instead, upload the ZIP there. Go to Settings, then Capabilities, then Skills, and upload the skill from that screen. The skill's only file is SKILL.md.
- Personal: unzip into ~/.claude/skills/
- Project only: unzip into .claude/skills/ in the project folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
~/.claude/skills/How to trigger a DPA review with natural requests
You do not need to remember a command. The skill runs when you use requests like the ones it was written for. These include saying 'review this DPA', 'check this data processing addendum', 'customer sent their DPA', 'is this DPA okay', or attaching a DPA to your message.
The skill accepts the DPA as a file, a Drive link or pasted text. The skill's argument hint lists these three forms. If you prefer a slash command, the source shows this form with a file name, although the exact slash name depends on how your plugin is set up.
- 'Review this DPA' with the file attached
- 'Check this data processing addendum' with a Drive link
- 'Customer sent their DPA, is this okay?' with the text pasted in
- Attach the DPA file and ask whether it is acceptable
/privacy-legal:dpa-review customer-dpa.pdfRead the output and check it before relying on it
The result is a review memo with suggested redlines. The skill saves it to your outputs folder, which the configuration file names under its Outputs section. Before you act on the memo, read the section on the federal sectoral overlay. The skill either lists the federally regulated categories it found or states that none applied, so you can see that the check ran.
The skill also looks for prior work on the same counterparty or processing activity, such as earlier triage results, PIA outputs or DPA reviews. If it finds one, the memo cites it. If it finds none, the memo says so. The memo is a first-pass review, so a qualified lawyer must check it.
- Review memo with suggested redlines, saved to the outputs folder
- Notes on prior triage, PIA or DPA review work for the same counterparty
- Federal sectoral overlay result, including when no overlay applied
- Lawyer review is still required before sign-off
What people use it for
- In-house privacy or legal teams reviewing a customer's DPA sent to them for signature
- Reviewing a vendor's DPA against the controller row of the playbook before accepting it
- Checking a new DPA against an earlier privacy impact assessment or triage result for the same vendor
- Producing consistent first-pass reviews across a team that shares one configured playbook
Frequently asked questions
How do I install the dpa-review skill?
Download the dpa-review ZIP from this page. Unzip it into ~/.claude/skills/ for personal use or into .claude/skills/ inside a project. In the Claude apps, upload the ZIP under Settings, then Capabilities, then Skills.
What do I need before dpa-review will work?
You need the Claude for Legal plugin and a privacy-legal configuration file at ~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md that contains a DPA playbook. You also need the DPA itself as a file, a Drive link or pasted text. Without a configured playbook the skill stops and asks for setup.
Is dpa-review free to use?
The skill is published under the Apache-2.0 licence. The source does not state any price, so check the licence text and your own plugin setup for the terms that apply to you.
Does dpa-review replace a lawyer?
No. The skill produces a first-pass review, and a qualified lawyer must check it. Jurisdiction and sector assumptions may not fit your situation, and the skill does not provide final legal sign-off.
Why does dpa-review ask whether we are the processor or the controller?
The review reads from a different row of the playbook for each role, and the recommendations invert depending on the answer. If the direction is unclear, the skill asks you before it runs the term-by-term review.
What does dpa-review do if it cannot find a playbook or prior work?
If the playbook still has placeholders, the skill stops and prompts setup. If it finds no prior triage, PIA or DPA review for the same counterparty, the memo says so explicitly, so the reviewing attorney knows the check ran.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use dpa-review if your team already has a written DPA playbook and wants consistent first-pass reviews of customer or vendor DPAs with a record of prior work. Pick something else if you have no playbook, or if you need a finished legal opinion, since the skill does not replace a qualified lawyer.
Download the skill