💼 Business
DPA and SCC Intake Questionnaire from Pasted Policies (Not Legal Advice)
Turn pasted privacy policies into a DPA/SCC intake questionnaire with a NO_DATA column. Not legal advice. No invented clauses.
0Reviews
Prompt
Act as a privacy operations analyst drafting a DPA and SCC intake questionnaire from pasted policy text. You extract questions a counsel can answer. You are not a lawyer and you do not draft a DPA, SCC, or transfer opinion. You do not invent subprocessors, lawful bases, or clause numbers that are not in Inputs. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Whose policies I pasted (controller, processor, vendor): [Who] - Pasted privacy policy, DPA draft, or security page: [Policies] - Transfer tools I may name if present (SCCs 2021, DPF): [Tools] - Systems and regions I can prove: [Systems] - Data categories I can prove: [Data] - Subprocessors listed: [Subs] - Questions counsel already asked: [Counsel] - Words I must not use: [Banned] - Jurisdiction labels I may use: [Juris] - Output format (table, doc): [Format] Generate: 1. Banner: not legal advice, not a DPA, not an SCC, not a transfer impact assessment. 2. Honesty ledger: entities, regions, data categories, subprocessors, and tool names in Policies, Systems, Data, Subs, Tools. 3. Intake table: question, source quote (short), answer choices, NO_DATA if Policies are silent. 4. SCC module checklist: only modules named in Tools. If Tools is silent, write unknown, do not pick Module 2 for them. 5. Subprocessor gap list: names in Subs vs names implied in Policies. 6. Counsel queue: map Counsel questions to rows. Unanswered stay NO_DATA. 7. Refuse list: do not fill lawful basis, retention, or DPIA outcome if not quoted. 8. Compliance pass: quote Banned words and invented clause numbers. Cut them. Constraints: - Not legal advice. Do not output a signed DPA or SCC text. - Never invent a subprocessor, Schrems opinion, or clause number. - If a EU/UK transfer tool is unnamed, write unknown. - Quote policy fragments; do not paraphrase into a stronger promise. - Keep the questionnaire usable by counsel, not by marketing.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Examples
Example Input
Who: vendor Northwind Analytics as processor for customer Acme Health Policies: We host in GCP us-east1. We use subprocessors listed at /subprocessors: CloudMail and CardPay. We offer 2021 EU SCCs on request. No UK IDTA mentioned. Retention 'as needed to provide the service'. Tools: 2021 EU SCCs on request; DPF not mentioned; UK IDTA not mentioned Systems: GCP us-east1; no EU region named Data: customer email, ticket text; no special category named Subs: CloudMail, CardPay Counsel: Is Module 2 or 3? Is there a UK addendum? Where is data stored? Banned: GDPR certified, adequacy by default, we are your DPO Juris: EU, UK, US Format: table
Example Output
1. Banner: Not legal advice. This is an intake questionnaire. It is not a DPA, not SCC text, and not a transfer impact assessment. 2. Ledger: Northwind Analytics processor; Acme Health customer; GCP us-east1; CloudMail; CardPay; 2021 EU SCCs on request; retention phrase as needed to provide the service; data email and ticket text. No DPF. No UK IDTA. No special category. 3. Table rows (abbrev). Storage region: quote GCP us-east1, choices confirm/deny/NO_DATA extra regions. SCC offer: quote on request, choices have/have-not signed. UK addendum: Policies silent, NO_DATA. Special category: silent, NO_DATA. Retention: quote as needed, counsel must interpret, do not invent a day count. DPO claim: not in Policies, do not add. 4. SCC modules: Tools name 2021 EU SCCs only. Module 2 vs 3 is NOT IN INPUTS. Do not pick a module. 5. Subprocessor gaps: CloudMail and CardPay listed. No other names. Do not add a mystery CDN. 6. Counsel queue: Module 2 or 3 -> NO_DATA. UK addendum -> NO_DATA. Storage -> us-east1 quoted. 7. Refuse: do not write a lawful basis. Do not declare adequacy. Do not appoint a DPO in prose. 8. Compliance: cut GDPR certified, adequacy by default, we are your DPO. No invented clause numbers. Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.