A data processing agreement is a contract between your organization and a service provider that handles personal data for you. It spells out what the provider is allowed to do with that data and how it keeps the data safe. For example, if a food bank pastes client names into an AI chat tool to draft letters, the agreement says whether the vendor may keep, reuse or share those names.
Why it matters
Under the GDPR, a data processing agreement is required when a provider processes personal data on your behalf. Many AI vendors offer one, often only on their business plans, so a free or personal account may leave you without this protection. Before you sign, read it with four questions in mind. Does it cover the vendor’s AI features? Does it say whether your data can be used to train their models? Does it name the other companies (subprocessors) that may touch your data? Does it explain how and when your data is deleted? A security report such as SOC 2 is a useful companion, but it does not replace the agreement. For more questions to put to a vendor, see our AI vendor assessment questions.
Published Updated