What is a data processing agreement?

A data processing agreement, often shortened to DPA, is the contract an organization signs with a provider that processes personal data on its behalf. It is mandatory under Article 28 of the GDPR as soon as a processor is involved, and sets what that provider may do with the data, how it protects it and what it must do when the relationship ends.

Controller and processor

The GDPR distinguishes two roles:

• The controller decides on the purposes and means: why data is processed and how. When an SME installs an AI assistant on its website to answer visitors, it is the controller
• The processor processes data on behalf of the controller and following its instructions. The platform that provides the assistant is a processor

The processor may itself use other providers, called sub-processors: a host, an e-mail service, a language model provider. Each must be bound by equivalent obligations, and the controller must be informed.

What the agreement must contain

Article 28 lists the mandatory elements. The agreement must describe the subject matter, duration, nature and purpose of the processing, the categories of data and data subjects, and the controller's obligations. Above all, it must commit the processor to:

1. Process data only on documented instructions from the controller, including for transfers outside the Union
2. Ensure confidentiality: the people authorized to process the data are bound by secrecy
3. Implement appropriate security measures, within the meaning of Article 32
4. Use another processor only with the controller's authorization, and impose the same obligations on it
5. Help the controller respond to requests from people exercising their rights
6. Help the controller with security, data breach notification and impact assessments
7. Delete or return the data at the end of the service, at the controller's choice
8. Make available the information needed to demonstrate compliance and allow audits

In 2021, the European Commission adopted standard contractual clauses for agreements between controllers and processors, which organizations can use as they are.

Points to check for an AI assistant

A standard data processing agreement does not always answer the questions specific to AI. Check in particular:

• The use of data to train models. The agreement must rule out the provider using your conversations or documents for its own purposes, including training or improving its models
• The list of sub-processors, including the model provider or providers, with their location
• Transfers outside the European Economic Area and the mechanism that safeguards them: adequacy decision, standard contractual clauses
• The retention period of conversations at the provider and at the model provider, and whether you can set it
• Deletion: the deletion deadline at the end of the contract, including in backups
• Incident notification: the time within which the provider warns you of a data breach, so you can meet the 72-hour deadline towards the supervisory authority

Common mistakes

• Accepting terms and conditions without reading the annex on data protection. The DPA is often a separate document that has to be requested explicitly
• Forgetting sub-processors. The agreement with the platform is not enough if the model provider processes messages under different terms
• Not archiving the agreement. If the supervisory authority or a customer asks, you must be able to produce it
• Not tracking changes. A provider may add a sub-processor; the agreement must provide that you are informed and can object

DPA and record of processing

The data processing agreement and the record of processing activities go hand in hand. The record describes your processing, its purposes, recipients and periods; the agreement guarantees that each recipient follows these rules. For an AI assistant, enter the "website assistant" activity in the record and file the platform's DPA and its list of sub-processors alongside it.

The data processing agreement with KernChat

For KernChat, the customer organization is the controller and KERN-IT acts as processor. The platform is hosted in the European Union. Messages are sent to the provider of the chosen language model (Google Gemini, Anthropic Claude or OpenAI) only to generate the answer, and KERN-IT does not use them to train a model. The privacy policy describes how this works and the sub-processors involved.