How to Draft a DPA and SCC Intake Questionnaire (Not Legal Advice)
Privacy intake goes wrong when a chatbot drafts SCC Module 2 for you and invents a subprocessor. Counsel then has to unwind a document that looked finished. You wanted questions with a NO_DATA column.
The matching generator is the DPA and SCC Intake Questionnaire from Pasted Policies (Not Legal Advice) (Dpa Scc Intake Questionnaire From Pasted Policies Not Legal Advice) prompt. Browse related cards in the PromptDig library (Browse more prompts). When a filled run survives, share the version you actually use (Share a prompt).
Banner that this is not a DPA
Turn pasted privacy policies into a DPA/SCC intake questionnaire with a NO_DATA column. Not legal advice. No invented clauses. Start by filling Inputs, not by asking the model to remember last week's run. If a field is blank, write NONE or NOT IN INPUTS and leave it blank through Generate. The card is built so the model cannot honestly invent a number, owner, URL, or command that you did not paste.
Paste these fields before you hit run:
Whose policies I pasted (controller, processor, vendor): [Who]
Pasted privacy policy, DPA draft, or security page: [Policies]
Transfer tools I may name if present (SCCs 2021, DPF): [Tools]
Systems and regions I can prove: [Systems]
Data categories I can prove: [Data]
Subprocessors listed: [Subs]
Questions counsel already asked: [Counsel]
Words I must not use: [Banned]
Jurisdiction labels I may use: [Juris]
Output format (table, doc): [Format]
That inventory is the honesty ledger. Anything that does not appear there is forbidden in the draft. If you catch yourself adding a nice-to-have after the run, you are no longer using the card. You are ghostwriting. Put the extra fact in Inputs and run again.
Quote the policy, do not strengthen it
Generate is numbered on purpose. Do not skip a step because the first paragraph looked done. The early steps exist to stop later prose from smuggling claims.
Walk the Generate list in order:
- Banner: not legal advice, not a DPA, not an SCC, not a transfer impact assessment.
- Honesty ledger: entities, regions, data categories, subprocessors, and tool names in Policies, Systems, Data, Subs, Tools.
- Intake table: question, source quote (short), answer choices, NO_DATA if Policies are silent.
- SCC module checklist: only modules named in Tools. If Tools is silent, write unknown, do not pick Module 2 for them.
- Subprocessor gap list: names in Subs vs names implied in Policies.
- Counsel queue: map Counsel questions to rows. Unanswered stay NO_DATA.
- Refuse list: do not fill lawful basis, retention, or DPIA outcome if not quoted.
- Compliance pass: quote Banned words and invented clause numbers. Cut them.
If a step asks for a version lock, quote the version from Inputs in the output. If a step asks for a refuse list, keep the refuse list in the published artifact, not in a sidebar you delete. Reviewers should see what the model was not allowed to do.
Leave module choice to counsel
Most failures are the same shape: a missing field gets a confident fill. A conversion rate appears. A Gradle task appears. A flash point appears. A caption appears on a job that asked for slide text only. Your review is to search the draft for numbers, names, and commands, then grep Inputs. No match means cut.
Honor the constraints as hard stops, not vibes:
- Not legal advice. Do not output a signed DPA or SCC text.
- Never invent a subprocessor, Schrems opinion, or clause number.
- If a EU/UK transfer tool is unnamed, write unknown.
- Quote policy fragments; do not paraphrase into a stronger promise.
- Keep the questionnaire usable by counsel, not by marketing.
When the card says not legal advice, not certification, not an exam dump, or not a caption engine, that sentence belongs at the top of the output. Deleting it to look more finished is how you inherit risk.
Gap the subprocessors you actually listed
Finish with the compliance pass the prompt already asks for. Quote the banned-word hits. Cut them. Print character counts when the job has a cap. Print word counts when the job has a budget. List gaps as gaps. Five missing facts are more useful than one smooth paragraph.
Tags on the card (dpa scc intake questionnaire, privacy policy intake not advice, standard contractual clauses intake) are a reminder of the job shape, not an invitation to wander into a neighboring cluster. If you need a different surface, open a different PromptDig card rather than stretching this one.
Fill the card, then run
Replace every bracket. Run on ChatGPT, Claude, or Gemini. Read the ledger first, then the artifact. If the model invents a commit, KPI, DOI, PEL, bid, or logo, discard the run. Tighten Inputs. Run again. Share the filled card that survived, not the first draft that sounded done.