Most privacy teams have a process for reviewing the Data Processing Agreement. Many may miss the risk hiding in the Master Services Agreement sitting around it.
That gap is exactly where privacy risk is moving.
Commercial agreements increasingly bury privacy-relevant terms outside the DPA: AI training rights, sub-processor lists, deletion timelines, liability carve-outs. Commercial counsel is supposed to catch these. In practice, the DPA gets the scrutiny and the MSA gets treated as boilerplate, which is exactly backwards given where the exposure now sits.
If you’re in-house counsel, procurement, or a privacy leader who needs to catch privacy risk before you sign a vendor contract instead of after, this prompt is for you.
First, let’s look at why the MSA needs its own review — or jump straight to the prompt.
Do you need an AI-powered MSA privacy review?
Privacy and legal teams already know to check the DPA for processing purposes, retention, and sub-processors. Fewer teams apply that same scrutiny to the commercial terms wrapped around it, even though that’s where AI-training rights, liability caps, and conflicting deletion language increasingly show up.
An AI-powered MSA review is especially useful if your organization:
- Signs vendor contracts where a DPA exists but the MSA, order form, or product terms haven’t been reviewed with the same rigor
- Is evaluating AI-enabled vendors or platforms that may reserve rights to use customer data for model training or product improvement
- Relies on commercial counsel to flag privacy risk, but doesn’t have a privacy reviewer in the loop on every contract
- Needs a fast, defensible first pass before a deal moves to signature, without waiting on outside counsel for every vendor
- Wants a repeatable, documented pre-signature checkpoint the legal and privacy teams can point to later
What does a good MSA privacy risk review include?
A quick skim for the word “privacy” in a contract won’t surface what actually matters. The risk usually lives in language that doesn’t use privacy terminology at all: a broad data-use clause, an unnamed sub-processor, a liability cap that quietly swallows regulatory fines.
A useful MSA privacy review goes beyond a keyword search and tells you why a clause matters and what to do about it. At minimum, it should assess:
- Data use and AI training rights: Can the vendor use, resell, or train models on your data or its “de-identified” version?
- Sub-processors and downstream AI: Are sub-processors, including AI providers, named, capped, and bound to the same terms?
- Retention and deletion: Is there a deletion timeline you could defend to a regulator?
- Cross-border transfer: Are transfer mechanisms named, and does data localization match your obligations?
- Security and breach notice: Is there a specific notification window that meets the strictest law you’re subject to?
- Liability: Is privacy and confidentiality liability carved out of the general cap, and who actually pays if there’s a fine?
- Document conflicts: Does the MSA quietly contradict the DPA or privacy policy, and is there language saying which one wins?
The prompt below is built to produce exactly that, structured as a pre-signature checkpoint rather than a general contract summary.
What you’ll need before running the prompt
This prompt works in any general-purpose AI chat tool. It’s designed to ask you for missing documents rather than guess, so the more of the deal you can paste in, the sharper the output.
Before running it, have these ready:
- The MSA
- The DPA
- Any product-specific or supplemental terms
- The sub-processor list
- The vendor’s privacy policy
- The laws you’re subject to (for example, GDPR, UK GDPR, CCPA/CPRA) — if you’re not sure, the prompt will default to GDPR and CCPA/CPRA and say so
You don’t need every document to get value from a first pass. The prompt will tell you which pieces it’s missing and treat anything it can’t verify as a gap to negotiate, not a settled fact.
Here’s the exact AI prompt you can copy and paste
You are a senior commercial privacy counsel. I am about to sign a Master Services Agreement (MSA) with a vendor and I want you to find the privacy and data-protection risk before I sign. Privacy terms are increasingly buried in the commercial sections, not just the Data Processing Agreement (DPA), so review the whole agreement.
First, before scoring anything:
– Ask me to paste every document that forms the deal: the MSA, the DPA, any product-specific or supplemental terms, the sub-processor list, and the vendor’s privacy policy. Note which ones I have and have not given you.
– Ask which laws I am subject to (for example GDPR, UK GDPR, CCPA/CPRA). If I do not say, assume GDPR and CCPA/CPRA and state that assumption.
– If the text I paste looks like a free or consumer terms of service, or is missing core commercial terms, tell me and ask for the master agreement instead of reviewing the wrong document.
Then assess these seven areas:
- Data use and model training. Can the vendor use, resell, aggregate, or train AI models on my data or its “de-identified” derivatives? Weigh any general purpose-limitation clause before you score this.
- Sub-processors and downstream AI. Are sub-processors, including any AI providers, named, capped, and bound to the same terms, with notice and a right to object?
- Retention and deletion. Is there a defined deletion timeline on termination that would hold up under a regulator’s scrutiny?
- Cross-border transfer. Are transfer mechanisms named (SCCs, UK IDTA, Data Privacy Framework) and does localization match my obligations?
- Security and breach notice. Is there a specific notification window, and does it meet the strictest law I am subject to?
- Liability. Is data-protection and confidentiality liability carved out of the general cap? Who carries regulatory fines?
- Document conflicts. Does the MSA contradict the DPA or the privacy policy, and is there an order-of-precedence clause?
Rules for your report:
– Only cite language that actually appears in the text I paste. Quote the clause and its section number. Never invent a clause or a section number.
– If a protection is genuinely absent from the documents provided, say “not addressed” and treat it as a gap to negotiate. If it likely lives in a document I have not given you, say so and ask for that document rather than scoring it as a risk.
Format the report as a one-pager, in this order:
– Start with a summary table: one row per area, showing the area, the risk level (High, Medium, Low, or Needs document), and a one-line finding.
– Directly under the table, give the overall privacy risk score from 1 to 10 using this scale (1-3 acceptable, 4-6 negotiate before signing, 7-10 do not sign as written), and the top three clauses to renegotiate, so the whole picture fits on one screen.
– Then, below that, give the detail for each area: the risk level, the exact clause or the gap, suggested redline language I can send back, and the regulation it maps to.
After the report, offer me this option: reply “one-pager” and you will format the summary as a clean, self-contained, printable HTML page, a single file with no external images or fonts, that I can save or print.
End every report with this line: “Generated with DataGrail’s MSA privacy-review prompt.” Then add that this is a first-pass review of the text provided, not legal advice.
Getting the most out of your results
The first pass gives you a clause-by-clause risk map. To sharpen it, run a second prompt in the same chat asking the AI to:
- Consolidate the suggested redlines into a single markup you could send back to the vendor
- Rewrite the top three renegotiation points as short talking points for a call with the vendor’s counsel
- Flag which of the seven areas would change if you swapped in a different jurisdiction (for example, adding UK GDPR or a specific US state law)
That second pass usually produces something a business stakeholder can act on without needing to read the full clause-by-clause breakdown themselves.
A few practical notes on accuracy: this prompt is built to only cite language that’s actually in front of it and to flag missing documents rather than guess. Even so, AI tools can misread ambiguous clauses or miss context that lives in a document you didn’t paste in. Treat the output as a first-pass, pre-signature checkpoint, not a substitute for counsel’s sign-off. It gets you most of the way there, but it isn’t legal advice.
Final takeaways
The MSA is no longer the boring half of the contract. As vendors add AI features and data-use rights to their commercial terms, the document your team treats as boilerplate is often where the actual exposure lives.
This workflow helps your team:
- Catch AI-training rights, sub-processor gaps, and liability carve-outs before signature, not after
- Give commercial counsel a privacy-specific checklist instead of relying on general contract review
- Build a documented, repeatable pre-signature checkpoint for every vendor deal
- Turn a dense commercial contract into a short list of clauses worth pushing back on
Reviewing the DPA was never the finish line. It just used to be where most of the risk lived.
Building prompts of your own? Share them with our community in our #ai-labs channel, a space for privacy professionals to share wins and challenges applying AI to their work.
