# DPA AI Vendor Checklist: What a Data Processing Agreement With an AI Vendor Should Cover

> What a data processing agreement with an AI vendor should cover: the Article 28 basics, plus model providers, training, retention, logs, transfers and deletion.

- Canonical: https://buffersoltech.com/blog/dpa-ai-vendor
- Author: BufferSol Editorial Team
- Published: 2026-10-22 · Updated: 2026-10-22

## Key takeaways
- If an AI vendor processes personal data for you, UK GDPR and EU GDPR require a written controller-processor contract covering the terms in Article 28.
- AI systems add questions a standard DPA template misses: which model providers see the data, whether it can be used for training, how long prompts and logs are kept, and what deletion means for embeddings and caches.
- List every sub-processor, including model and hosting providers, with the country where each processes data.
- Transfers outside the UK or EU need a valid mechanism, such as adequacy, the UK IDTA or Addendum, or the EU standard contractual clauses, plus a transfer risk assessment where required.
- Treat the DPA as part of the design: the answers decide where the system is hosted and which providers it can use.

A data processing agreement (DPA) with an AI vendor should cover everything UK GDPR and EU GDPR Article 28 requires of any processor contract, and then answer the questions AI adds. Which model providers will see your data, and where? Can your data be used for training? How long are prompts, outputs and logs kept? What does deletion mean for embeddings, caches and evaluation sets? And how will AI-specific incidents, such as data exposed through a model's output, be reported?

This DPA AI vendor checklist maps each standard term to its AI-specific questions. It is practical guidance from an agency that signs these agreements, not legal advice, so have your counsel review the final text. For the wider vetting process, see our [guide to choosing an AI automation agency](/blog/ai-automation-agency-guide).

## When you need a DPA

If a vendor processes personal data on your behalf, you are the controller and the vendor is a processor, and the law requires a written contract between you. The ICO's guidance on [what needs to be included in the contract](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/) says the contract "must include" details of the processing: its subject matter and duration, nature and purpose, the types of personal data, the categories of data subject, and the controller's obligations and rights.

AI projects touch personal data more often than buyers expect. A support agent reads customer emails and order histories. An invoice workflow reads supplier contact details. A knowledge assistant indexes documents that mention staff and clients. Assume a DPA is needed unless you have confirmed no personal data is involved.

## Map the contracts before you draft

AI systems often involve three or more parties, and the DPA only works if everyone's role is clear. Draw the data flow first.

| Setup | Who contracts with the model provider | What that means for the DPA |
| --- | --- | --- |
| Vendor runs the system and holds the provider account | The vendor | The model provider is the vendor's sub-processor and must be listed in your DPA |
| System runs in your cloud, with your own provider account | You | The provider relationship is direct; your DPA with the vendor covers the vendor's own access |
| Self-hosted model in your environment | Nobody | No external model provider; the DPA focuses on the vendor's access and support |

The second and third setups give you more control over data location and provider terms, at the cost of managing those accounts yourself. They are worth considering for any system that handles sensitive or regulated data, and they simplify the sub-processor list considerably. Whichever you choose, write down who holds each account and who can see what, and attach that map to the DPA.

## The Article 28 terms, and the AI question each one raises

```infographic
{"type":"compare","title":"Article 28 terms and the AI questions they raise","columns":["Standard Article 28 term","AI-specific question to settle"],"rows":[
{"label":"Documented instructions","a":"Process only on the controller's documented instructions","b":"Do the instructions cover prompts, outputs, logs, embeddings and evaluation sets?"},
{"label":"Confidentiality","a":"People processing the data are bound by confidentiality","b":"Who at the vendor can read prompts, traces and conversation logs?"},
{"label":"Security","a":"Appropriate technical and organisational measures","b":"Prompt-injection testing, output checks, access scoping and log protection"},
{"label":"Sub-processors","a":"Only with authorisation, under equivalent terms","b":"Are model, embedding, hosting and monitoring providers all listed, with countries?"},
{"label":"Data subject rights","a":"Help the controller respond to requests","b":"Can personal data be found and removed from indexes, caches and logs?"},
{"label":"Assisting the controller","a":"Help with security, breaches and impact assessments","b":"Will the vendor support a DPIA with design and data-flow details?"},
{"label":"End of contract","a":"Delete or return the data","b":"Does deletion cover vector stores, fine-tuning data, backups and provider-side copies?"},
{"label":"Audits","a":"Make information available and allow audits","b":"Can you see a sample trace, the sub-processor list and test reports?"}
],"source":"ICO Article 28 contract guidance; AI questions from BufferSol's DPA checklist"}
```

## Five clauses to add for AI systems

### 1. Model providers and other sub-processors

List every provider that will process personal data: the model API, embedding service, vector database, hosting platform, logging and monitoring tools. For each, state what data it receives and the country where processing happens. Require notice before any new sub-processor is added, with a right to object. Model providers change often, so this list should be kept current, not written once.

### 2. Training and improvement

State clearly that your data, including prompts, outputs, files and feedback, will not be used to train or improve any model, by the vendor or by its providers, unless you agree in writing. Ask the vendor to show the provider terms that support this. Many providers offer business terms that exclude API data from training, but terms differ and change, so check each one.

### 3. Retention of prompts, outputs and logs

AI systems create data that ordinary software does not: full prompts, model outputs, tool calls and traces. These logs are essential for debugging and audit, and they often contain personal data. Agree how long each is kept, where, who can access it and when it is deleted or anonymized. Ask the same question about the model provider's own retention of API traffic.

### 4. Deletion that reaches every copy

"Delete the data" is harder in an AI system. Personal data can sit in a vector index, a cache, an evaluation set, a fine-tuning dataset, backups and provider-side logs. The DPA should require deletion or return across all of them at the end of the contract, and the vendor should be able to remove a specific person's data on request where your use case requires it.

### 5. AI-specific incidents

Breach clauses usually assume a database leak. AI systems add other routes. The [OWASP Top 10 for LLM applications](https://genai.owasp.org/llm-top-10/) lists sensitive information disclosure second, and prompt injection first: a model can reveal data in its output, or be manipulated into revealing it. Make sure the incident clause covers these cases, with notification timelines that let you meet your own legal deadlines.

## International transfers

If personal data leaves the UK or the EU, through the vendor, the model provider or any other sub-processor, the transfer needs a lawful basis.

For the UK, the ICO's [guide to international transfers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/) explains that restricted transfers must be covered by UK adequacy regulations, an appropriate safeguard such as the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum, or an exception. If you rely on a safeguard, a transfer risk assessment is also required.

For the EU, the European Commission's [standard contractual clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en) are pre-approved model clauses for transfers to recipients outside the EU/EEA. The modernised version was issued on 4 June 2021.

The simplest way to reduce transfer questions is architectural: host the system in your own cloud account, in your chosen region, and choose model endpoints in that region where providers offer them.

## How this works with BufferSol

For generative AI work, we use enterprise API terms that exclude client data from model training, and we can deploy in a client's own cloud account or with private, self-hosted models when required. We follow GDPR and UK GDPR principles and sign NDAs and data processing agreements on request. In our [enterprise knowledge assistant](/portfolio/enterprise-knowledge-assistant), answers use only documents each user is allowed to see, through single sign-on, which keeps access rules aligned with the source systems. In our [AI customer support agent](/portfolio/ai-customer-support-agent), the agent works only through the store, helpdesk and shipping tools it needs for the job.

## A short pre-signing checklist

1. The processing description covers prompts, outputs, logs and indexes, not just "customer data".
2. Every sub-processor is listed with its country, including model and embedding providers.
3. Training use is excluded in writing, supported by provider terms.
4. Retention periods are set for prompts, outputs, traces and backups.
5. Deletion covers vector stores, caches, evaluation and fine-tuning data.
6. Transfers have a valid mechanism, and a transfer risk assessment where required.
7. Incident clauses cover data exposed through model output or manipulation.
8. You can audit: sub-processor list, a sample trace and security test results.

If you want help working through this checklist for a system you are planning, our [generative AI](/services/generative-ai), [AI agents](/services/ai-agents) and [autonomous workflows](/services/autonomous-workflows) teams can walk through the data flows with you, or you can [talk to an engineer](/contact).

## Frequently asked questions
### Do we need a DPA with an AI agency?
If the agency or the system it builds will process personal data on your behalf, yes. Under UK GDPR and EU GDPR, processing by a processor must be governed by a written contract with specific minimum terms. Even if no personal data is involved, a short data-handling clause in the main contract is still sensible, because AI systems often process business-sensitive information.

### Is a model provider like OpenAI or Anthropic a sub-processor?
Usually, when your vendor sends personal data to the provider's API as part of the service it runs for you. The provider then processes that data on the vendor's behalf, which makes it a sub-processor that should be listed in the DPA. If you hold the model provider account yourself, the relationship may be direct instead. Map who holds which contract before signing.

### Can we stop an AI vendor from training models on our data?
You can and should address it in writing. Ask the vendor to state that your data will not be used to train or improve any model, by them or by their providers, and to show the provider terms that support that. Many providers offer business terms that exclude API data from training, but check the current terms of each provider rather than assuming.

## Sources
1. [What needs to be included in the contract?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/), Information Commissioner's Office
2. [A brief guide to international transfers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/), Information Commissioner's Office
3. [Standard contractual clauses (SCC)](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en), European Commission
4. [2025 Top 10 Risk & Mitigations for LLMs and Gen AI Apps](https://genai.owasp.org/llm-top-10/), OWASP Gen AI Security Project