A data processing agreement (DPA, in German “Auftragsverarbeitungsvertrag” or AVV) is the contract Art. 28 GDPR requires whenever a service provider processes personal data on your behalf. With AI tools, the vendor is almost always such a processor. Without a DPA, the contractual basis is missing, no matter how good the tool’s privacy settings are.
Almost every one of my posts on individual tools contains the same sentence: check whether there is a DPA. What is rarely explained is the second step. A DPA exists, and you accepted it with one click when you signed up for the business plan. But what does it actually say, and how do you tell whether it is enough for the way you use the tool?
This post is a guide for going through an AI vendor’s DPA yourself. You do not need legal training. You need the document, an hour, and the questions below.
When do I need a DPA with an AI vendor?
You need a DPA as soon as your employees enter personal data into an AI tool or the tool accesses such data. That happens sooner than many people think. A client’s name in an email you want summarized is enough. So are meeting minutes with attendee names.
If you use a tool strictly for general text with no personal reference at all, you do not need a DPA. In practice that is hard to sustain, and a policy that demands it is rarely followed day to day. More on this in the post on processing personal data with AI.
Free consumer versions usually come without a DPA. The review ends right there: the tool is not suitable for personal data.
Where do I find my AI vendor’s DPA?
With the large vendors the document is usually called a Data Processing Addendum or Data Protection Addendum. It is often part of the terms for business and enterprise plans and applies automatically when you sign up. There is no separate paper to sign.
Art. 28(9) GDPR explicitly allows the contract to be concluded in electronic form. A DPA accepted online is therefore fine in principle. What matters is that you save the version you accepted as a PDF. Vendors update these documents, and in an audit you need to show what applied at which point in time.
What does Art. 28 GDPR say must be in the DPA?
Art. 28(3) GDPR sets out the minimum content of the contract. Go through the points in order and note where each one appears in the document.
- Subject matter, duration, nature and purpose of the processing. Plus the type of personal data and the categories of data subjects. AI vendors often just say “customer data” here. That is common, but your own documentation should be more specific.
- Processing only on documented instructions. The vendor may process the data only as you instruct. This explicitly includes transfers to third countries.
- Confidentiality. The people at the vendor who work with the data are bound to confidentiality.
- Security under Art. 32 GDPR. The DPA usually refers to an annex with technical and organisational measures (TOMs). Check that this annex actually exists and is not just mentioned.
- Sub-processors. The vendor may only engage other providers with your authorisation. Under a general authorisation, the vendor must inform you of changes and give you the chance to object (Art. 28(2)).
- Assistance with data subject rights. If a client requests access or erasure, the vendor must help you respond.
- Assistance with your obligations under Art. 32 to 36. This includes data breaches and the data protection impact assessment.
- Deletion or return at the end of the contract.
- Evidence and audits. The vendor provides the information you need to demonstrate compliance and allows for audits. With large vendors this usually happens through certifications and audit reports rather than your own on-site inspection.
If one of these points is missing, it is not a detail. The contract then does not meet the legal minimum.
Which questions do AI tools add?
The mandatory content under Art. 28 applies to every service provider, from the payroll bureau to cloud storage. With AI vendors there are five extra questions I ask in every review.
Are your inputs used for training? This is the most important question. A processor may only process your data for your purposes. If it uses them to improve its own models, it pursues a purpose of its own. Art. 28(10) GDPR addresses this: a processor that determines the purposes itself is treated as a controller for that processing. Look in the DPA or the linked product terms for an explicit statement that customer data is not used for training. A setting in the menu is good. A contractual commitment is better.
How long are prompts and outputs retained? Many vendors keep inputs for a limited period, for example to detect abuse, even after the chat history is deleted for the user. Note the period and the purpose. I describe this in detail for one vendor in the post on Azure OpenAI and the GDPR.
Can the vendor’s staff view content? And if so, under what conditions? For most businesses, tightly limited human review in case of suspected abuse is acceptable. For professionals bound by secrecy, it belongs in the DPIA.
Which sub-processors are on the list? This matters particularly with AI vendors, because the underlying model often comes from another company or runs on a third party’s cloud infrastructure. Get the list, file it, and find out how you will be told about changes. What such a change means in practice is shown in the post on Anthropic becoming a Microsoft sub-processor.
Where is the data processed, and on what basis does it leave the EU? If the DPA promises EU processing, does that cover all data or only stored data? For transfers to the US, the question is whether the vendor is certified under the EU-US Data Privacy Framework or relies on standard contractual clauses. The background is in the post on data location and cloud AI.
Who is my contracting party?
A point that often gets overlooked: check which legal entity you are contracting with. Many US vendors have a subsidiary in Ireland or another EU country that signs contracts with European customers. That does not change where the data is processed. It does determine who your counterpart is and which law governs the contract. The name of that entity belongs in your records of processing.
Is a DPA enough for law firms and tax advisors?
No. A DPA covers the data protection side. For professionals bound by secrecy in Germany, § 203 StGB (German Criminal Code) applies on top. If you pass client data to a service provider, you must make sure that provider is bound to confidentiality. Professional rules spell this out, in § 43e BRAO for lawyers and § 62a StBerG for tax advisors: an agreement in text form and notice of the criminal consequences. A standard DPA usually does not cover this.
For firms, that means the DPA and the confidentiality agreement are two documents, and you need both. The details are in the post on client data and § 203 StGB.
What do I do if the DPA does not fit?
Small businesses practically cannot negotiate DPAs with the large AI vendors. That is normal and no reason to panic. Your options lie elsewhere:
- Change plan. DPAs often differ between plan tiers, for example on data location or retention. A higher tier may solve the problem.
- Limit use. If the DPA is not sufficient for certain types of data, exclude that data for this tool in your AI acceptable use policy.
- Document the risk. If you consciously choose a tool, record which points you checked and why you consider the remaining risk acceptable. This goes into the DPIA if one is required.
- Switch vendors. If key points are missing, such as a commitment not to train on your data, that rules the tool out.
Checklist: review an AI vendor’s DPA in one hour
- Get the DPA and save the accepted version with its date as a PDF.
- Note the contracting party, meaning the exact legal entity and its registered seat.
- Go through the mandatory content under Art. 28(3) and note where each point appears.
- Check the TOM annex to see that it exists and is specific.
- Training excluded? Look for a contractual commitment, not just the setting.
- Retention periods for prompts, outputs and logs.
- Human access by the vendor: whether, when, by whom.
- File the sub-processor list and record how you will be informed of changes.
- Document data location and the transfer mechanism for third countries.
- For professionals bound by secrecy: sort out a separate confidentiality agreement under § 203 StGB.
- Transfer the result into your records of processing and set a date for the next review.
The last point is the one most often missing. A DPA is not a document you review once and forget. AI vendors change their terms and sub-processors more often than most other providers. How the results go into your records is explained in the post on documenting AI use under Art. 30 GDPR.
The next step
Pick the AI tool your business uses most and answer just one question: is the DPA saved as a file in your records? If not, that is your first task this week.
If you want to know where your business stands on contracts, documentation and settings overall, take my free AI compliance check. It takes 2 minutes and shows you where to start.
Jose Lugo is a CISSP-certified AI compliance consultant. He advises law firms, tax advisors and financial services firms in Germany on introducing AI tools in a GDPR-compliant way.