Review Data Processing Agreements Against GDPR Article 28 Requirements

id: ai-gdpr-dpa-reviewer
namespace: company.legal

description: |
  AI agent that reviews Data Processing Agreements (DPAs) against
  GDPR Article 28 requirements and flags missing or non-compliant clauses.

inputs:
  - id: dpa_text
    type: STRING
    displayName: Paste the DPA text to review
    defaults: |
      DATA PROCESSING AGREEMENT

      1. Subject Matter: Processor shall process personal data on behalf
         of Controller for the purpose of providing cloud hosting services.

      2. Duration: This agreement shall remain in force for 24 months.

      3. Data Types: Names, email addresses, IP addresses, usage logs.

      4. Security: Processor shall implement appropriate technical measures.

      5. Sub-processors: Processor may engage sub-processors as needed.

      6. Data Transfer: Data may be stored in any of Processor's global
         data centers.

      7. Termination: Upon termination, Processor shall delete all data
         within 90 days.

  - id: controller_jurisdiction
    type: SELECT
    displayName: Controller's jurisdiction
    defaults: EU Member State
    values:
      - EU Member State
      - EEA (non-EU)
      - UK (post-Brexit)
      - Switzerland
      - International (with EU data subjects)

tasks:
  # The agent reviews the DPA clause by clause against Article 28 GDPR,
  # flags gaps, and generates a compliance scorecard. Web search retrieves
  # recent EDPB recommendations and standard contractual clauses.
  - id: dpa_review
    type: io.kestra.plugin.ai.agent.AIAgent
    description: Review DPA against GDPR Article 28 and flag compliance gaps
    # Mistral Large, European AI model by Mistral AI (Paris, France).
    # DPA text may reference specific data subjects and processing activities;
    # keeping the analysis within EU infrastructure aligns with GDPR principles.
    #
    # For air-gapped or on-premise deployments:
    #   type: io.kestra.plugin.ai.provider.Ollama
    #   endpoint: http://ollama:11434
    #   modelName: mistral-large
    provider:
      type: io.kestra.plugin.ai.provider.MistralAI
    configuration:
      temperature: 0.1
      maxToken: 6144
    contentRetrievers:
      - type: io.kestra.plugin.ai.retriever.TavilyWebSearch
        maxResults: 5
    systemMessage: |
      You are a senior privacy lawyer specializing in GDPR compliance and
      data processing agreements. You review DPAs against the requirements
      of Article 28 GDPR and related provisions.

      For each Article 28(3) mandatory clause, you must:
      1. Check if the clause is PRESENT in the DPA
      2. Assess if the clause is COMPLIANT (sufficient detail and legal precision)
      3. Flag any clause as NON-COMPLIANT or MISSING
      4. Provide specific REMEDIATION language when needed

      Use web search to reference:
      - EDPB Guidelines 07/2020 on controller/processor concepts
      - European Commission Standard Contractual Clauses (SCCs) for comparison
      - Recent enforcement actions related to DPA deficiencies

      Be precise and cite specific GDPR articles. Output in structured Markdown.
    prompt: |
      Review the following Data Processing Agreement:

      CONTROLLER JURISDICTION: {{ inputs.controller_jurisdiction }}

      DPA TEXT:
      {{ inputs.dpa_text }}

      Perform a systematic review covering ALL mandatory elements of
      Article 28(3) GDPR:

      ## Compliance Scorecard
      Rate each required element: COMPLIANT / PARTIALLY COMPLIANT / MISSING

      ## Article 28(3) Mandatory Clauses Checklist

      ### (a) Processing instructions
      Does the DPA require the processor to process data ONLY on documented
      instructions from the controller? Does it cover the case where EU/Member
      State law requires processing?

      ### (b) Confidentiality obligations
      Are persons authorized to process data committed to confidentiality
      or under a statutory obligation?

      ### (c) Security measures (Article 32)
      Does the DPA reference specific technical and organisational measures?
      Are they merely "appropriate" (vague) or detailed and verifiable?

      ### (d) Sub-processor conditions
      - Is prior specific or general written authorisation required?
      - Must the processor inform the controller of new sub-processors?
      - Does the controller have a right to object?
      - Are the same data protection obligations imposed on sub-processors?

      ### (e) Data subject rights assistance
      Does the processor commit to assisting the controller in responding
      to data subject requests (Articles 15-22)?

      ### (f) Security, breach notification, and DPIA assistance
      Does the processor assist with Articles 32-36 obligations?

      ### (g) Data deletion or return
      Does the DPA specify deletion OR return of data after the end of
      services? Is the 90-day timeline appropriate?

      ### (h) Audit rights
      Does the controller have the right to conduct audits and inspections?
      Does the processor contribute to and allow audits?

      ## International Transfer Assessment
      If the DPA involves data transfers outside the EEA:
      - Are appropriate safeguards in place (Chapter V)?
      - Are SCCs or BCRs referenced?
      - Has a Transfer Impact Assessment been conducted?
      - Flag: "Data may be stored in any of Processor's global data centers"
        is a RED FLAG without appropriate safeguards.

      ## Risk Summary & Recommendations
      Provide a prioritized list of remediation actions, starting with the
      most critical gaps.

  # Step 2, Export the compliance review to a Google Sheet.
  - id: format_review
    type: io.kestra.plugin.scripts.python.Script
    containerImage: python:3.11-slim
    inputFiles:
      review.md: "{{ outputs.dpa_review.textOutput }}"
    outputFiles:
      - dpa_review.csv
    script: |
      import csv

      with open("review.md") as f:
          report = f.read()

      sections = [s.strip() for s in report.split("## ") if s.strip()]
      with open("dpa_review.csv", "w", newline="") as f:
          w = csv.writer(f)
          w.writerow(["Section", "Content"])
          for section in sections:
              parts = section.split("\n", 1)
              title = parts[0].strip()
              content = parts[1].strip() if len(parts) > 1 else ""
              w.writerow([title, content])

  - id: create_sheet
    type: io.kestra.plugin.googleworkspace.sheets.CreateSpreadsheet
    title: "DPA Review, {{ inputs.controller_jurisdiction }}, {{ now() |
      date('yyyy-MM-dd') }}"

  - id: load_review
    type: io.kestra.plugin.googleworkspace.sheets.Load
    spreadsheetId: "{{ outputs.create_sheet.spreadsheetId }}"
    from: "{{ outputs.format_review.outputFiles['dpa_review.csv'] }}"
    format: CSV
    range: "Sheet1"

  # Step 3, Notify the privacy-legal Slack channel with the review link.
  - id: notify_slack
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    messageText: "*DPA Review Complete*

      *Jurisdiction:* {{ inputs.controller_jurisdiction }}

      <{{ outputs.create_sheet.spreadsheetUrl }}|Open DPA Review in Google
      Sheets>"

pluginDefaults:
  - type: io.kestra.plugin.ai.provider.MistralAI
    values:
      apiKey: "{{ secret('MISTRAL_API_KEY') }}"
      modelName: mistral-large-2512
  - type: io.kestra.plugin.ai.retriever.TavilyWebSearch
    values:
      apiKey: "{{ secret('TAVILY_API_KEY') }}"
  - type: io.kestra.plugin.googleworkspace.sheets.CreateSpreadsheet
    values:
      serviceAccount: "{{ secret('GCP_SERVICE_ACCOUNT_JSON') }}"
  - type: io.kestra.plugin.googleworkspace.sheets.Load
    values:
      serviceAccount: "{{ secret('GCP_SERVICE_ACCOUNT_JSON') }}"
  - type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    values:
      url: "{{ secret('SLACK_WEBHOOK') }}"