AI vendor DPA checklist
Every AI vendor that touches your customers’ or staff’s personal data is a processor under GDPR, and that triggers a hard requirement: a Data Processing Agreement that contains the specific clauses listed in Article 28. Vendors’ template DPAs vary wildly in quality, and a missing clause can leave you exposed when a regulator or customer asks how the data is governed. This tool screens a pasted DPA against the mandatory list in seconds.
How it works
You paste the vendor’s full DPA text and the tool scans it for each Article 28 obligation — documented-instructions processing, confidentiality, security measures under Article 32, sub-processor authorisation and flow-down, assistance with data-subject rights, breach notification, deletion or return on termination, and audit rights — plus AI-specific concerns like international transfer safeguards and whether the vendor commits not to train its models on your data. Each clause is marked present or apparently missing, with critical clauses separated from secondary ones so you know what blocks sign-off.
The mandatory Article 28 clauses the tool checks
Article 28(3) sets out the specific content a DPA must include. The checklist maps every obligation:
Processing only on documented instructions — the vendor must only process your personal data as you direct, not for its own purposes unless legally required. This is the foundational duty that makes them a processor rather than an independent controller.
Confidentiality — people who process the data must be bound by confidentiality.
Security measures (Article 32) — appropriate technical and organisational measures to protect the data. The DPA should reference or describe these rather than defer entirely to the vendor’s security page.
Sub-processor controls — the vendor must get your prior authorisation before using sub-processors, impose equivalent duties on them, and remain liable to you for their compliance. This is the clause most often weakened — many DPAs provide a list of existing sub-processors and give the vendor blanket permission to add new ones with only a notice period rather than prior consent.
Assistance with data-subject rights — the vendor must help you respond to erasure, access, portability, and correction requests relating to data they hold.
Breach notification — the vendor must notify you of a personal data breach without undue delay so you can meet your own 72-hour notification obligation to the supervisory authority.
Deletion or return — at the end of the contract, all personal data must be deleted or returned, at your choice. Verify this is specific about timing and format, not an open-ended commitment.
Audit rights — you must be able to verify the vendor’s compliance, either through your own audit or an approved third-party auditor.
The AI-specific clause: model training
The tool also checks for a commitment that the vendor will not use your data to train, fine-tune, or improve its models. This clause does not appear in Article 28 as such — it is a purpose limitation. Many AI vendors include it voluntarily because enterprise customers demand it; many consumer-tier agreements do not. If it is absent, the vendor’s general terms govern, and those often reserve training rights. This is typically the highest-impact gap in AI vendor DPAs.
Tips and notes
- A missing flag means read, not reject. The same duty can be worded a dozen ways; the tool points you to where to look rather than giving a final ruling.
- Push hardest on sub-processors and training. The two clauses vendors most often weaken are the right to control onward sub-processors and a clear no-training commitment — both are where your data quietly travels.
- Pair with a risk matrix. A clean DPA tells you the contract is sound; a third-party risk matrix tells you whether the vendor’s actual practices match what they promised.