Can AI vendors use my customer data to train their models without a DPA?

No, not lawfully where personal data is involved. Training a model is processing under GDPR, and it needs both a documented Article 28 instruction and a valid Article 6 lawful basis. The EDPB's Opinion 28/2024 and the enforcement actions against OpenAI and Clearview establish that processing personal data for training without a lawful basis is a violation, and that the resulting model's deployment can be tainted too. This is why enterprise AI DPAs now carry an express training-prohibition clause rather than relying on a vendor's general promise.

What are Standard Contractual Clauses and do I need them?

Standard Contractual Clauses are European Commission pre-approved model contract terms, in their 2021 modernized version, that legalize transfers of EEA personal data to countries lacking an adequacy decision. You need them when you send EEA personal data abroad and no other mechanism applies. For U.S. recipients, the EU-U.S. Data Privacy Framework can substitute if the recipient is certified. For everywhere else, the SCCs remain the standard route, and you attach the module matching your transfer, usually controller-to-processor.

How long does a data processor have to delete customer data?

GDPR Article 17 requires erasure 'without undue delay,' which regulators read as roughly one month for an individual request. For end-of-contract deletion, the addendum should set concrete numbers: cryptographic erasure of live data within about 30 days of termination and purge from backups within about 90 days, matching typical backup-rotation cycles. A vendor that will only promise vague 'reasonable' deletion is a vendor whose deletion you cannot evidence in an audit.

What happens if a sub-processor breaches the DPA?

The original processor, your direct vendor, remains fully liable to you under Article 28(10), as if it had committed the breach itself. That is the central reason the addendum must require the vendor to impose materially identical protections on every sub-processor, maintain a current list, and give you notice and an objection right before adding one. You do not chase the sub-processor; you hold your vendor accountable, and the contract is what makes that stick.

What are the largest fines for AI and DPA-related data violations?

The CNIL's 20 million euro penalty against Clearview AI in October 2022, plus 100,000 euros per day for non-compliance, and the Italian Garante's 15 million euro fine against OpenAI in December 2024 are the headline figures. Both turned on the absence of a lawful basis under Article 6 for processing personal data, Clearview for scraped facial images and OpenAI for its training corpus. Article 28 violations sit in the lower fine tier of up to 10 million euros or 2 percent of worldwide turnover, while lawful-basis failures can reach the higher tier.

Does the EU-U.S. Data Privacy Framework replace SCCs?

Only for transfers to certified U.S. organizations. The Framework, adopted under the European Commission's July 2023 adequacy decision, lets you send EEA personal data to a DPF-certified U.S. recipient without separate Standard Contractual Clauses. It does not cover recipients in other countries, and it does not help if your U.S. vendor has not actually self-certified. SCCs remain the fallback for non-DPF destinations and for any case where you cannot confirm certification, so most cross-border AI DPAs keep both options available.

Is a data processing addendum the same as a business associate agreement?

No, though they serve a parallel purpose. A DPA addresses GDPR and CCPA obligations for personal data generally. A Business Associate Agreement is the HIPAA-specific contract required when a vendor handles protected health information for a U.S. covered entity. If your AI tool touches health data, you typically need both, and the DPA often incorporates the BAA by reference rather than duplicating its terms. Signing one does not satisfy the other.

Do I need a separate AI addendum if I already have a standard DPA?

Often yes, if your existing DPA predates the AI-specific concerns. A pre-2025 DPA usually says nothing about model training, fine-tuning, benchmarking, the EDPB's anonymization guidance, or whether trained data can be removed. Rather than rewriting the whole agreement, many parties bolt on an AI exhibit that adds the training prohibition, inference restrictions, and an honest answer to the deletion-from-a-model question. If you are signing fresh, fold those terms into the main addendum from the start.

AI Data Processing Addendum (DPA): Template, GDPR Article 28 Terms & 2026 Rules

Key Takeaways

•A data processing addendum is the written contract GDPR Article 28(3) requires before any processor, including an AI vendor, touches personal data on your behalf. Skip it and both sides sit exposed to fines up to 10 million euros or 2 percent of worldwide turnover.
•The AI-specific clause to get right is the training prohibition. The EDPB's Opinion 28/2024 and the 15 million euro Garante fine against OpenAI make clear that personal data fed into a model without a lawful basis can taint the model's deployment, not just the training run.
•CCPA covers different ground from GDPR. A California service-provider contract under Section 7051 carries nine required terms and, from January 1, 2026, must address automated decision-making and risk-assessment cooperation. You often need both regimes covered in one addendum.
•Sub-processor governance is non-negotiable. Under Article 28(10) your vendor stays fully liable for any sub-processor it hires, so the addendum needs a current sub-processor list, 30-day change notice, and an objection right.
•Cross-border transfers out of the EEA need a mechanism: the EU-U.S. Data Privacy Framework for certified U.S. recipients, or the 2021 Standard Contractual Clauses for everyone else. Name the mechanism in the addendum and attach the module you rely on.
•Deletion has to be concrete: cryptographic erasure of live data within roughly 30 days of termination, backups purged within about 90 days, and a written deletion certificate. Vague 'we delete data' language fails an audit.

Reviewed for accuracy by the document.com legal team. Educational information, not legal advice.

What Is AI Data Processing Addendum (DPA)?

An AI data processing addendum (DPA) is a binding written contract between a data controller and an AI vendor that limits how the vendor may process personal data, and it satisfies the processor-agreement requirement in GDPR Article 28(3). It is the document that turns a vendor's marketing promise of 'we take privacy seriously' into enforceable obligations a regulator and a court will recognize.

You are the controller in this relationship: you decide why and how personal data gets used. The AI vendor is the processor, acting only on your written instructions. The addendum is the paperwork that proves that relationship exists and that the processor agreed to specific limits before it ever saw a single record.

The word 'addendum' matters. This is almost always bolted onto a master agreement, an order form, or a SaaS terms of service rather than signed standalone. It supplements the commercial contract with the privacy-and-security terms that the underlying deal usually skips.

What makes the AI version different from a generic DPA is the model-training problem. A traditional processor stores or transmits your data and then deletes it. An AI vendor can ingest your data into a training corpus, where it stops being a discrete record you can simply erase and becomes statistical weights inside a model. The AI DPA exists to draw a hard line around that risk.

Why This Matters Now

On December 20, 2024 the Italian Garante fined OpenAI 15 million euros, finding the company had no lawful basis under GDPR Article 6 for the personal data in its training corpus, among other failures. It was the first major generative-AI fine in the EU, and it landed squarely on the issue an AI DPA is built to control: documented instructions and a verified lawful basis for what the model ingests.

The regulators have written down their position. The European Data Protection Board's Opinion 28/2024, adopted December 18, 2024, says that personal data unlawfully processed to train an AI model can make the model's later deployment unlawful too, 'unless the model has been duly anonymised.' That single finding turns a sloppy training pipeline into a downstream liability for everyone who uses the model.

Web-scraping is not a loophole. The CNIL hit Clearview AI with a 20 million euro penalty in October 2022 plus 100,000 euros per day, rejecting the argument that 'publicly available' images escaped the Article 6 lawful-basis requirement. If your vendor's training data was scraped, that history sits upstream of you.

California's requirements tighten on January 1, 2026, when provisions of the California Privacy Protection Agency's regulations add cybersecurity-audit, risk-assessment, and automated-decision-making-technology obligations. Service-provider contracts now need cooperation clauses for ADMT and risk-assessment reporting that older CCPA DPAs never contemplated.

The FTC put U.S. vendors on notice. In a January 2024 staff statement, the agency warned that an AI company's privacy commitments in its contracts must actually limit model training and exclude customer data from fine-tuning, and that quietly changing those terms to grab training data can be an unfair or deceptive practice.

EU customers increasingly treat data residency and an explicit AI-training prohibition as non-negotiable line items in procurement. If you sell software and cannot produce a clean AI DPA on request, you lose the deal before legal even reviews it.

The Legal Backbone

GDPR Article 28: the eight required processor terms

Article 28(3) of the General Data Protection Regulation requires a written contract before any processor handles personal data for a controller, and it spells out the minimum content. The processor must act only on the controller's documented instructions; ensure that everyone with access is bound by confidentiality; implement the Article 32 security measures; not engage a sub-processor without authorization; assist the controller in answering data-subject requests; help with breach notification and impact assessments; delete or return the data at the end of the engagement; and make available the records needed to prove compliance, including submitting to audits. Those eight items are the checklist. If your AI DPA is missing one of them, it is not a compliant Article 28 contract, regardless of what the cover page says. Violations of Article 28 carry the lower fine tier under Article 83(5)(e), up to 10 million euros or 2 percent of worldwide annual turnover, whichever is higher.

GDPR Article 17: erasure and the deletion clause

Article 17, the right to erasure, gives data subjects the right to have their personal data deleted 'without undue delay,' a phrase the GDPR treats as roughly one month. A controller cannot honor that right if its processor will not cooperate, so the AI DPA has to commit the vendor to technical measures that support deletion requests and to a concrete post-termination deletion timeline. The article carves out exceptions, including where processing is necessary to comply with a legal obligation or for freedom of expression, but those are the controller's calls to make, not the processor's. Model training complicates erasure: once data has been used to train a model, deleting the source record does not necessarily remove its influence from the model weights. A serious AI DPA addresses head-on whether trained data can be 'forgotten,' which is exactly the open question the EDPB flagged in Opinion 28/2024.

GDPR Article 6 and the EDPB Opinion 28/2024 on AI training

Article 6 is the lawful-basis rule: there is no lawful processing without one of six grounds, such as consent or legitimate interest. For AI, this is the heart of the matter, because training a model on personal data is itself an act of processing that needs its own basis. The EDPB's Opinion 28/2024, issued December 18, 2024, tackles when AI development can rely on legitimate interest, when a model can be considered anonymous, and the consequences of getting it wrong. The sharpest finding in it: if the training data was processed unlawfully, that illegality can flow through to the deployment phase unless the model has been genuinely anonymized. For your addendum, that means restricting the vendor to your documented instructions under Article 28 does not get you all the way there. The instructions themselves have to rest on a valid Article 6 basis, and the simplest way to keep your own house in order is to prohibit training on your data outright.

CCPA Section 7051: the nine service-provider terms

Under California's CCPA regulations, a business that shares personal information with a service provider needs a binding written contract carrying the terms set out at Section 7051 of Title 11. The vendor must commit to comply with CCPA obligations equivalent to the business's own, let the business monitor compliance, notify the business if it can no longer meet its obligations, help fulfill consumer requests, and refrain from selling the data or using it for any purpose outside the contract. The CCPA does not require Standard Contractual Clauses the way GDPR does, and the base statute does not expressly restrict model training. The CPPA's regulations effective January 1, 2026 narrow that gap, layering on cooperation duties around automated decision-making technology and risk assessments, so a 2026-ready service-provider addendum has to reach issues the 2020-era template ignored.

Cross-border transfers: SCCs and the EU-U.S. Data Privacy Framework

Moving EEA personal data to a country without an adequacy decision requires a transfer mechanism. The 2021 modernized Standard Contractual Clauses, adopted by the European Commission, use a modular structure covering controller-to-processor, processor-to-processor, and other flows, and you attach the module that matches your arrangement. For transfers to the United States, the EU-U.S. Data Privacy Framework, in force under the Commission's adequacy decision of July 10, 2023, lets you send data to a DPF-certified U.S. organization without separate SCCs. The Framework replaced Privacy Shield, which the Schrems II ruling struck down in July 2020, and it added a redress route through a Data Protection Review Court. Name the mechanism in the addendum, confirm the recipient's certification or attach the SCC module, and do not assume the DPF covers a recipient that has not actually self-certified.

What a strong AI data processing addendum actually contains

Start with the roles and the subject matter. The addendum should name the controller, name the processor, and describe in an exhibit the categories of data subjects, the categories of personal data, the nature and purpose of the processing, and the duration. When a regulator audits the relationship, the processing-details exhibit is the first thing it reads, and a vague one signals that nobody thought carefully about scope.

The instruction clause is the spine. State that the processor may handle personal data only on the controller's documented instructions, with this addendum and the underlying service agreement being those instructions, and that the processor will tell the controller if it believes an instruction violates data-protection law. The Garante's OpenAI decision turned on the absence of a documented lawful basis for what the model ingested, so this clause is where you tie processing to permitted purposes and nothing else.

Then the AI training prohibition, the clause that sets this apart from a generic DPA. Spell out that the vendor will not use customer personal data to train, fine-tune, or improve any model, will not use it for benchmarking or feature detection, and will not retain it for those purposes after the service is delivered. Mature contracts back this with teeth: liquidated damages per violation, or a representation that the vendor's foundation models were not trained on unlawfully processed personal data. Industry standard clauses, such as the Common Paper prohibit-AI-training term, exist precisely because buyers stopped trusting general assurances.

Security comes next, and Article 32 sets the floor. Specify encryption at rest, with AES-256 being the going market standard, and TLS 1.2 or higher in transit. Add role-based access control on a least-privilege basis, audit logging of personal-data access with a defined retention window, and pseudonymization for sensitive fields where feasible. Microsoft's published DPA, for instance, commits to 256-bit AES at rest and TLS 1.2-plus in transit, which is a useful benchmark when you are negotiating against a smaller vendor's thinner promises.

Sub-processor governance protects you from your vendor's vendors. The addendum should require either specific or general written authorization for sub-processors, maintain a current published sub-processor list, give you at least 30 days' notice before a new sub-processor is added, and give you the right to object. Under Article 28(10) the original processor stays fully liable for its sub-processors' failures, so insist that the vendor flows down identical protections. OpenAI's April 2025 update moved to a 30-day notice plus objection model, and Microsoft has signaled a separate 30-day notice track specifically for AI sub-processors, which tells you where the market is heading.

Data-subject rights and breach notification round out the cooperation duties. The processor must assist you in responding to access, deletion, and other requests within your statutory deadlines, and must notify you of a personal-data breach quickly, with 24 to 48 hours now the typical contractual ask, well inside the GDPR's 72-hour controller deadline. Include audit and assurance rights here: either a direct audit right or, more commonly, an agreement to provide a current SOC 2 Type II report or equivalent.

Deletion and return is where loose drafting costs you. Commit the vendor to delete or return all personal data on termination, with cryptographic erasure of live data within about 30 days, purge from backups within roughly 90 days to match standard backup-rotation cycles, and a written deletion certificate. For the AI context, add language addressing whether data already used in training can be removed, acknowledging the EDPB's view that unlawfully trained data creates lingering deployment risk. If the vendor cannot promise to un-train your data, you want to know that before you sign, not after a subject access request.

Finish with international transfers and liability. Identify the transfer mechanism, whether DPF certification or the relevant 2021 SCC module, and attach it. Address data residency if EU customers require it. Then set out liability and indemnification, clarifying the processor's financial accountability, including for sub-processor breaches under Article 28(4). None of this works if the commercial liability cap in the master agreement silently swallows the privacy obligations, so check how the cap interacts with this addendum before you call it done.

When You Need This

You are buying or selling SaaS, and personal data of EU or California residents will pass through the vendor's systems. Sign the addendum before any records move; Article 28(3) requires the written contract to be in place before processing starts.

You are deploying an AI tool, an LLM API, a copilot, a transcription service, that will see customer names, emails, support tickets, or any other personal data. The training-prohibition and deletion clauses are the reason this exists.

An enterprise customer's procurement team has sent you a DPA to sign, or a security questionnaire asking for yours. You need your own clean version to negotiate from rather than accepting theirs wholesale.

You are sending personal data out of the EEA, to a U.S. cloud region or an offshore support team, and need to document the transfer mechanism the GDPR requires.

You are a controller engaging a sub-processor chain and want the liability flow-down and notice rights that keep you from being blindsided when your vendor swaps in a new provider.

Your existing DPA predates 2025 and says nothing about AI training, the CCPA 2026 ADMT rules, or the EDPB's anonymization guidance. An out-of-date addendum can be worse than none, because it looks like coverage you do not have.

How to Fill Out AI Data Processing Addendum (DPA)

1. Identify the roles and attach a processing-details exhibit
Name the controller and the processor, then build the exhibit that describes the categories of data subjects, the types of personal data, the nature and purpose of processing, and the duration. Be specific. 'Customer account data and support communications, processed to deliver the AI assistant service, for the term of the subscription' beats a one-line generality that an auditor will pick apart.
2. Write the documented-instructions clause
State that the processor handles personal data only on your documented instructions, that this addendum and the service agreement constitute those instructions, and that the processor must flag any instruction it believes breaks the law. Confirm the lawful basis under Article 6 sits with you as controller, and that the instructions never authorize processing beyond the stated purposes.
3. Insert the AI training prohibition with teeth
Prohibit use of your personal data to train, fine-tune, improve, benchmark, or evaluate any model. Add that the vendor will not retain the data for those purposes after service delivery. Where leverage allows, attach liquidated damages per violation or a representation that the vendor's models were not built on unlawfully processed personal data. This is the clause regulators and EU buyers look for first.
4. Set the Article 32 security floor
Require encryption at rest at AES-256, TLS 1.2 or higher in transit, role-based least-privilege access, audit logging with a stated retention period, and pseudonymization for sensitive fields. Reference the vendor's current SOC 2 Type II report or equivalent assurance, and make delivery of that report on request an express obligation in the addendum.
5. Lock down sub-processors
Require written authorization for sub-processors, a maintained and accessible sub-processor list, at least 30 days' advance notice of any addition, and an objection right. Require the vendor to bind every sub-processor to materially the same terms, and confirm in writing that the vendor remains fully liable for them under Article 28(10).
6. Define breach notification and data-subject assistance
Set a notification window of 24 to 48 hours from the vendor's awareness of a breach, comfortably inside your own 72-hour GDPR deadline, and specify what the notice must contain. Require the vendor to help you fulfill access, deletion, and other data-subject requests within your statutory timelines, including the roughly one-month Article 17 erasure clock.
7. Specify deletion, return, and the AI-forgetting question
Commit the vendor to cryptographic erasure of live data within about 30 days of termination, backup purge within about 90 days, and a written deletion certificate. Add language on whether data already used in any model can be removed, and capture the vendor's honest answer, because the EDPB has signaled that unlawfully trained data can taint deployment that you cannot simply delete your way out of.
8. Name the transfer mechanism and reconcile liability
Identify whether transfers rely on EU-U.S. Data Privacy Framework certification or a specific 2021 SCC module, and attach the operative module. Add a CCPA service-provider rider with the Section 7051 terms and the 2026 ADMT cooperation duties if California data is in scope. Finally, check that the master agreement's liability cap does not silently gut these privacy obligations, and have a qualified privacy lawyer review the package before signing.

Key Terms Defined

Controller: The party that determines the purposes and means of processing personal data. In an AI vendor relationship, you, the customer, are almost always the controller, because you decide why the data is being used and which tool processes it.
Processor: A party that processes personal data on the controller's behalf and on its instructions, without deciding the purposes itself. An AI vendor running an inference service over your customer data is acting as your processor, which is why GDPR Article 28 forces a written contract between you.
Sub-processor: A third party a processor engages to help process the data, such as a cloud host or an AI infrastructure provider underneath your direct vendor. Under Article 28(10) the original processor stays fully liable for its sub-processors, so the addendum must govern who they are and how they are added.
Lawful basis: One of the six grounds in GDPR Article 6 that makes processing legal, such as consent, contract necessity, or legitimate interest. Training an AI model on personal data is itself processing that needs its own lawful basis, the exact point the Garante found missing in the OpenAI case.
Standard Contractual Clauses (SCCs): European Commission pre-approved model contract terms, in their modernized 2021 form, that legalize transfers of EEA personal data to countries without an adequacy decision. You attach the module matching your transfer type, controller-to-processor for most AI vendor deals.
Cryptographic erasure: Deleting data by destroying the encryption keys that protect it, rendering the underlying ciphertext permanently unreadable. It is the practical deletion method most DPAs specify, because it can purge data across distributed storage faster than overwriting every copy.

Legal Authorities & Sources

This page is grounded in primary law. The statutes and official resources below are the authorities behind the guidance above. Verify the current text of any statute before relying on it.

Frequently Asked Questions

Ready when you are

Create your AI Data Processing Addendum (DPA) in minutes.

Answer a few questions and download a clear, attorney-drafted document that cites the controlling law and is ready to sign.

Create AI Data Processing Addendum (DPA)

No account · Free to preview

AI Data Processing Addendum (DPA)

Key Takeaways

What Is AI Data Processing Addendum (DPA)?

Why This Matters Now

The Legal Backbone

GDPR Article 28: the eight required processor terms

GDPR Article 17: erasure and the deletion clause

GDPR Article 6 and the EDPB Opinion 28/2024 on AI training

CCPA Section 7051: the nine service-provider terms

Cross-border transfers: SCCs and the EU-U.S. Data Privacy Framework

What a strong AI data processing addendum actually contains

When You Need This

How to Fill Out AI Data Processing Addendum (DPA)

1. Identify the roles and attach a processing-details exhibit

2. Write the documented-instructions clause

3. Insert the AI training prohibition with teeth

4. Set the Article 32 security floor

5. Lock down sub-processors

6. Define breach notification and data-subject assistance

7. Specify deletion, return, and the AI-forgetting question

8. Name the transfer mechanism and reconcile liability

Key Terms Defined

Related Documents