analyse-dpa-fournisseur-hugo-salard

What it does

Analyses systematically a Data Processing Agreement (DPA) for compliance with article 28 RGPD, EDPB guidelines 07/2020 and 02/2024, CCT 2021 (Implementing Decision 2021/914), EDPB 01/2020 recommendations, and Regulation (EU) 2024/1689 (AI Act). Produces a clause-by-clause report (18 clauses: 13 mandatory + 5 supplementary) with a diagnostic using symbols 🟢/🟡/🔴, actionable remediations, detailed analysis of international transfers, IA Regulation verification, and questions to ask the supplier.

How it works

• It refers to: loading reference resources for clause-by-clause comparison, remediation dictionary, and a final report template.
• It profiles the practitioner role as a DPA expert and instructs to assess the 18 clauses against a predefined grid, capturing presence, exact text, conformity, and a status per clause. It requires consistency checks between status and remediations, and between referenced annexes and their presence.
• For transfers, it creates a dedicated three-subsection section (Table, analysis prose, and government-access focus) if transfers are identified; otherwise, it states no transfers.
• If IA is identified or suspected, it adds a dedicated IA regulation section detailing systems identified, applicable obligations, and rights interactions.
• It follows a seven-step workflow: identify practitioner name, receive the DPA, read and map the DPA, clause-by-clause analysis, remediations, transfers section, IA section, then synthesize the final report following the exact model structure.

When to use it

• Triggers include: "analyse de DPA", "audit DPA", "vérifier un DPA", "DPA fournisseur", "data processing agreement", "art. 28 RGPD", "sous-traitant RGPD", "négociation DPA", "review DPA", "conformité contrat sous-traitance".
• Use when the need is a rapid, structured, clause-by-clause review of a supplier DPA, with concrete remediations and questions for the supplier.

What it can touch

• References and loads: resources/grille-analyse-dpa-art28.md, resources/clauses-remediation-types.md, and templates/modele-rapport-sortie.md for the required structure.
• Outputs: a final report following templates/modele-rapport-sortie.md structure, including a clause-by-clause table and dedicated sections for transfers and IA if applicable.

Caveats

• This is a technical compliance analysis, not legal advice.
• The practitioner validates all statuses and remediations before use; the final decision rests with the practitioner and client.
• The tool cites and uses external reference materials but does not replace them; ensure you supply all referenced annexes and attachables when evaluating the DPA.