How to Evaluate an AI Vendor Data Processing Agreement Before Using It With Client Files
Check your AI vendor's DPA for training bans, sub-processors, and deletion terms.
AI tools for privacy-conscious professionals need more than a promise not to train on client files. Before using an AI assistant with sensitive client information, evaluate the agreement for the exact account tier, its training prohibition, every downstream processor, and enforceable retention and deletion terms. A standard data processing agreement is only the starting point for assessing whether a tool protects client confidentiality.
Why standard DPA templates fail when client files enter an AI system
A buyer may expect a data processing agreement, or DPA, to cover files that are uploaded and how they will later be deleted. An AI agreement must also account for full prompt text, model outputs, tool-call traces, vector embeddings, evaluation sets, and provider-side API logs. The file is only the starting point. A template written for conventional software can meet Article 28’s basic requirements but leave unclear how these other data flows are handled.
Article 28 GDPR requires a written controller-processor contract whenever a vendor processes personal data for you. Prompts, embeddings, and logs fall within that obligation when they contain personal data, so the contract must cover their processing before a finished document leaves the system. What, precisely, have you instructed the vendor to process? The answer must cover these AI-specific categories rather than rely on a broad reference to “service delivery.” Even with a DPA, deployers of high-risk systems still need a lawful basis for processing and must carry out the operational duties that apply directly to them.
The plan-tier problem: whether a DPA exists at all depends on which product you signed up for
Start by checking the vendor’s agreement for your account. OpenAI provides a data processing addendum for ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu, ChatGPT for Healthcare, ChatGPT for Teachers, and its API. It does not cover Free or Plus accounts.
Anthropic incorporates its DPA into commercial terms for Claude Team, Enterprise, and the API, but not Free, Pro, or Max. ElevenLabs illustrates a separate distinction between contractual coverage and training defaults. Its Enterprise tier is excluded from training by default, subject to what is necessary to provide services, while self-serve plans, including their API use, permit training unless the customer opts out. API access alone is not a privacy guarantee.
Identify every team member’s plan before reviewing clauses. Then find out how its DPA takes effect, whether by accepting commercial terms, signing a separate form, or using an admin click-through. Download the version that was accepted and note its date, because the live document may change later. If the vendor cannot produce a DPA for the account in use, resolve that gap before proceeding.
Controller and processor roles: catching the "service improvement" escape clause
In the controller-processor relationship being evaluated, you are the controller and the vendor processes data only on your documented instructions. Those instructions include the agreement and your use of the product. The role definition anchors every later restriction.
Look for permitted purposes such as “as required to deliver the services and improve the vendor's products.” The second limb opens a separate purpose that can encompass model training unless a later clause expressly excludes it. Does the vendor say it is the controller for that use? If so, it is reserving authority to decide uses. Require a scope annex naming the data categories, including names, contact details, message content, and uploaded documents, and the people concerned, including clients and staff.
The training prohibition clause: does this AI tool train on your client data?
An acceptable prohibition covers customer data, prompts, outputs, and derived artifacts, and bars their use to train, fine-tune, evaluate, improve, or conduct reinforcement learning on any model without prior written consent. A narrow promise about “training” is not enough. Fine-tuning or retrieval augmentation must still be checked even if the vendor calls it something else.
Put this restriction in the contract itself, since a policy page can change unilaterally. Extend it to aggregated and anonymised forms of customer data, so the protection does not depend on the vendor’s anonymisation quality. Then ask for the model provider terms that back up the promise. If a downstream provider has different terms, they can weaken what looks like a firm promise from the tool vendor.
Training transparency is a separate procurement check. California AB 2013, in effect January 1, 2026, requires AI developers deploying to California residents to publish a high-level training-data summary covering 12 required categories. Ask an applicable vendor for that disclosure. Its existence does not replace a contractual prohibition on using your client data.
Sub-processor transparency: mapping every party that touches client data
A single workflow may involve a model API, an embedding service, a vector database, a hosting platform, and logging or monitoring tools. Each participant needs a defined place on the map. Request its company name, the data it receives, its processing purpose, and the country where processing occurs, with equivalent protections binding each sub-processor.
If a tool uses a large language model but lists no model provider, escalate the omission. When the vendor holds the provider account, that relationship is part of its processing chain, while a buyer who holds the account has a direct relationship with the provider. Self-hosting is another structural option, and where the system runs in your cloud with your model provider account, the vendor’s DPA covers its own access.
Changes need usable notice and objection rights. Anthropic gives reasonable notice before new sub-processors get access and allows a set 10-day window to object on reasonable privacy or security grounds. Use that as a benchmark, supported by email or a subscribable notification page that announces changes.
International transfer mechanisms: checking that the SCCs named in the DPA are actually valid
The map of countries where data is processed shows which transfer documents to ask for. For EU personal data leaving the EEA, the available mechanisms include an adequacy decision, Standard Contractual Clauses, or Binding Corporate Rules. Naming SCCs is not sufficient by itself. The EU replaced its earlier models in June 2021, so references to the 2010, 2004, or 2001 versions are a red flag.
Which SCC version and annexes are actually incorporated? For transfers that rely on SCCs, can the vendor provide a Transfer Impact Assessment that covers the laws in the country receiving the data and the supplementary measures? If it instead relies on the EU-US Data Privacy Framework, is that specific vendor certified? These checks require documentary evidence.
Check for the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs rather than assuming EU clauses cover UK GDPR obligations. Request the assessment for relevant US or other non-adequate-country processing, and have legal counsel review the final text before signing.
Retention, deletion, and what "deletion" actually means for AI-generated data
A no-training promise does not establish zero retention. Client information may persist in prompt logs, vector indexes, caches, evaluation sets, fine-tuning datasets, backups, and provider-side API logs. What does deleting a conversation actually remove? Require the vendor to walk through each data type rather than treating “conversation history” as a complete inventory.
For every category, the agreement should specify the retention period, storage location, access permissions, and deletion or anonymisation trigger and method. End-of-contract deletion must include derived stores and downstream copies, with concrete timelines for live-data erasure and later backup purges. Human review needs limits as well. Any staff access to flagged conversations should have stated purposes and confidentiality obligations recorded in the DPA.
Anthropic changed its consumer terms in August 2025 so Free, Pro, and Max users must opt out of training, with potentially much longer retention for users who allow it. Its enterprise API is governed by a separate no-training DPA. Before termination, contractual portability rights should also permit usable, non-proprietary exports of prompts, evaluation sets, retrieval indexes, and any fine-tuned weights, with a defined period of transition assistance.
Breach notification deadlines and why "without undue delay" is not a deadline
Retention defines what remains available to be exposed. The breach clause must then define how quickly the buyer learns of an incident, because “without undue delay” supplies no measurable deadline. GDPR gives controllers a 72-hour supervisory authority reporting window. A vendor that investigates for several days before notifying can leave the buyer unable to meet that obligation.
Require a short deadline in hours from discovery of a confirmed or suspected breach, with enough initial information to begin an assessment. Explicit coverage should include unintended disclosure through model outputs, prompt-injection exfiltration, and unauthorised access to logs or vector stores. Pair it with a security annex specifying encryption, access controls, audit logging, and prompt-injection testing. A late notice may also show that the buyer could face losses beyond the vendor’s liability cap.
Liability caps, output disclaimers, and what the vendor is actually promising to stand behind
The master services agreement can sharply limit the financial value of DPA protections. Vendors usually cap total liability at the fees paid in the past 12 months and disclaim any promise that outputs are accurate, complete, or fit for purpose. Confidentiality protection is not an accuracy warranty. A hallucinated case citation or a missed material contract risk can leave clients facing losses far beyond the contractual cap, so that gap must be negotiated or its cost weighed in the decision.
Microsoft indemnifies commercial customers for copyright infringement in paid Copilot outputs when they use the built-in guardrails and content filters. These are benchmarks for IP protection. For client-facing deliverables, ask whether comparable indemnity is available and confirm that outputs are assigned to you while prompts and fine-tuning data remain your property.
Regulatory duties remain with the deployer where applicable. The duties under EU AI Act Article 26 start on 2 December 2027 for Annex III high-risk systems and 2 August 2028 for Annex I high-risk systems. Ask for the vendor’s risk classification in writing before signing. Also secure audit rights in the commercial terms and DPA, including access to a SOC 2 Type II report, an on-demand sub-processor list, and a sample trace, so contractual promises have an evidence chain.
Running the evaluation before data changes hands: practical order of operations
Begin with the highest-stakes threshold questions before uploading anything. The first five minutes should establish the plan tier and whether its DPA is effective. If it is not, stop and resolve that first. Next, agree on the controller-processor roles and scope annex, reject a service-improvement controller carve-out, and then check whether downstream provider terms uphold the training prohibition in the contract.
Once those checks are done, get the full sub-processor map and ask in writing for any missing countries, descriptions of data, or details of how notice is given. Use that map to check the transfer instruments and assessments. Then match retention and deletion terms to each data category, confirm a breach deadline in hours, and read the liability cap and output disclaimer in the master agreement. Consider IP indemnity and any additional protections required by applicable deployer duties.
For the highest-sensitivity legal, medical, financial, or regulated files, contractual restrictions may still be insufficient for the context. An architecture designed not to collect or retain the data addresses that dependency structurally. Where a processor offers no suitable DPA, however, excluding it from client-personal-data workflows is the practical route that avoids an unmanaged Article 28 gap. Document the accepted agreements, evidence, and evaluation decisions before use, and review them annually.
