AI Vocabulary · 06 Own Your AI
What is Data Processing Agreement (DPA)?
The contract that sets out how a provider may handle personal data on your behalf. Required under the GDPR.
When a service provider processes personal data for you, for example when you send customer emails to an AI tool, the GDPR requires a written contract between you and the provider. That contract is the data processing agreement, sometimes called a data processing addendum.
A DPA typically defines what data is processed and why, security measures, sub-processors, where data is stored, how long it is kept, how deletion works and how international transfers are handled. Most business-grade AI services offer a standard DPA; many free consumer apps do not.
Why it matters for you
Using an AI tool with personal data and no DPA in place is a common compliance gap in small companies. It is also a useful filter: a provider that can't give you a clear DPA is probably not the right home for sensitive data.
Own it
Keep a simple list of your AI tools with a link to each signed DPA, the storage region and whether training on your data is excluded. It takes an hour and answers most questions from clients and auditors. This entry is an overview, not legal advice.
Where it comes from
The contract comes from European data protection law. The 1995 Data Protection Directive already required a contract between a company and anyone processing data on its behalf, and the GDPR's Article 28, applicable since 25 May 2018, spelled out what that contract must contain. Every AI provider that handles personal data for you is a processor in this sense, which is why serious providers offer a ready-made DPA.
Related
Your AI Learning Hub
Learn the whole AI Vocabulary, step by step, and build with it. Build it. Own it.