What is a data processing agreement?

When a data processing agreement is needed

As soon as an external service provider processes personal data for your company and is bound by your instructions, it is usually a processor within the meaning of the GDPR. This applies to many IT services: hosting, e-mail, CRM – and AI platforms into which employees enter customer names, e-mails or documents. You remain responsible for the processing; the agreement regulates how the service provider has to handle the data. The legal text of Art. 28 is available on EUR-Lex.

What Art. 28 GDPR requires

The agreement must set out the subject matter and duration, the nature and purpose of the processing, the type of personal data, the categories of data subjects and the rights and obligations of the controller. In addition, the processor must in particular undertake to:

• process data only on documented instructions, including with regard to transfers to third countries;
• ensure that authorised persons are committed to confidentiality;
• take the technical and organisational measures (TOMs) required under Art. 32 GDPR;
• engage sub-processors only with prior authorisation and impose the same obligations on them;
• support the controller in responding to data subject requests;
• support the controller with security, data breach notifications and data protection impact assessments;
• delete or return all personal data at the end of the service;
• provide all information necessary to demonstrate compliance and allow audits.

The agreement must be in writing, which may also be in electronic form. The EU Commission has published standard contractual clauses that can be used for this purpose.

What to check in AI services

1. Sub-processors: which model providers, hosting and other services are involved, and where?
2. Third countries: are data transferred outside the EU, and on what legal basis?
3. Use for training: is it ruled out that inputs are used to train models?
4. TOMs: are the measures concrete and comprehensible, or only generic?
5. Deletion: how and when are chats, documents and logs deleted?
6. Changes: how are you informed about new sub-processors, and can you object?

Limits

A data processing agreement alone does not make an AI use lawful. You still need a legal basis for the processing, transparency towards data subjects and, where appropriate, a data protection impact assessment. Further information is provided by the data protection authorities, for example the BfDI. This entry is not legal advice.

The AVV in AIPE

The data processing agreement for AIPE pursuant to Art. 28 GDPR can be viewed online on the AVV page, including the technical and organisational measures and the list of sub-processors with their locations. The platform is hosted primarily at Hetzner in Germany. What GDPR-compliant AI use requires overall is explained in the guide GDPR and AI and under GDPR-compliant AI.