Key Takeaways
- •Controller and processor roles follow actual activity. A contract label cannot settle an independent-purpose use.
- •Describe specific data, people, operations, instructions and locations before approving access.
- •Model training is a separate choice; permission for service processing does not create unrelated training rights.
- •Identify real subprocessors, transfer instruments and operational security measures. Selecting an acronym does not supply an annex.
- •The builder includes conditional California and HIPAA terms. Resolve applicability and the actual arrangements before preparing signatures.
Reviewed for accuracy by the document.com legal team. Educational information, not legal advice.
What Is AI Data Processing Addendum (DPA)?
An AI data-processing addendum sets contractual requirements for a provider handling personal data on a customer’s behalf. It connects the services arrangement to documented instructions, safeguards, permitted recipients and assistance duties.
AI services may handle more than an uploaded file. Prompts, logs, retrieval stores, outputs and model artifacts can contain personal data. The agreement should identify those activities and the practical controls used to carry out the parties’ obligations.
Why This Matters Now
A provider may use multiple infrastructure and model suppliers. Customers need an accurate picture of that processing chain and how new recipients are approved.
A generic promise to delete data may not describe backups, legal retention or data remaining in a model. Record actual capabilities, limitations and required remediation.
Service-provider status, international transfers and health information each raise different requirements. Review them against the actual service, not a default setting.
The Legal Backbone
Document lawful instructions and actual roles
A processor arrangement needs a real processing specification and mandatory contractual duties where GDPR applies. Instructions cannot be made lawful merely by repeating them. Independent-purpose processing needs its own role and legal assessment.
Address the full processing chain
Record authorized recipients, their activities and locations, approval or objection procedures, and binding obligations. The initial processor’s applicable responsibility for its subprocessors remains distinct from the consequences of choosing its own purposes and means.
Use actual transfer arrangements
Determine whether each transfer is restricted, which mechanism can cover it, and what signed instruments, annexes, assessments or supplementary measures are needed. A selection in a wizard is not a completed transfer instrument.
Apply the relevant additional terms
California service-provider and contractor terms concern specified purposes, restrictions, assistance and oversight. HIPAA business-associate arrangements need defined PHI uses and operational duties as well as security language. Neither rider certifies the parties’ actual compliance.
Start with the processing that will actually happen
Identify the services agreement and real parties, roles, locations and supplied schedules. Resolve any independent or joint-controller activity separately.
Specify categories of people and data, processing operations, purpose, duration, lawful instructions and customer obligations.
Choose whether defined model operations on the customer’s behalf are permitted. Record scope, evidence and actual handling of residual personal data.
Describe security measures, personnel controls, audit information and practical assistance procedures.
Identify subprocessors and authorization procedures, then assess each actual transfer and its required instruments.
Set usable incident and request contacts, response deadlines, assessment assistance and return/deletion arrangements.
Complete applicable California or HIPAA details, reconcile risk allocation and mandatory rights, and resolve outstanding review items before preparing signature fields.
When You Need This
Use for an actual customer/provider relationship in which the provider processes personal data on the customer’s behalf.
Use to document AI-specific handling, supplier chains and operating procedures alongside the underlying services agreement.
Use separate or additional arrangements for independent controllers, joint controllers, restricted transfers or regulated records when the facts require them. This form does not authorize otherwise unlawful processing.
How to Fill Out AI Data Processing Addendum (DPA)
1. Map the service
Describe data flows, purposes, operations, people, storage and remote access. Determine who makes the relevant decisions.
2. Write usable instructions
Record permitted activities and recipients, approval procedures and what happens when an instruction is unlawful or changes.
3. Verify suppliers and transfers
Identify the actual processing chain and provide the applicable signed instruments and annexes before affected processing starts.
4. Agree on response procedures
Name contacts, information, timelines and assistance for incidents, individual requests, assessments and ending services.
5. Complete applicability and review
Resolve California, HIPAA and other applicable duties; reconcile supplied schedules and retain an unsigned draft while material questions remain.
Key Terms Defined
- Processing specification
- The agreed description of data, people, operations, purposes, duration and instructions.
- Subprocessor
- A further provider engaged to perform processing on behalf of a processor within the relevant legal framework.
- Restricted transfer
- A movement or access arrangement requiring a transfer assessment and lawful safeguards under the applicable data-protection rules.
- Business associate
- A person or organization with a qualifying HIPAA relationship and associated duties; the title alone does not create that status.
- Model residual data
- Personal information that may remain in model artifacts or related systems and needs an actual assessment when handling rights or deletion obligations.
Related Documents
Processing addendum and dataset license
A processing addendum controls handling on another party’s behalf. A dataset license grants specified rights in a collection. Depending on the arrangement, both may be needed.
Processing addendum and transfer clauses
A processing addendum describes the service and operating duties. Required transfer clauses and annexes must actually be supplied and cover the relevant transfer.
Processing addendum and business-associate agreement
HIPAA applies to qualifying health-information relationships. Its required contract terms and operational arrangements need attention in addition to any other privacy regime.
Legal Authorities & Sources
This page is grounded in primary law. The statutes and official resources below are the authorities behind the guidance above. Verify the current text of any statute before relying on it.
- Irish DPC: processor contracts
- Irish DPC: mandatory processor contract provisions
- EDPB Opinion 22/2024: processor and subprocessor obligations
- European Commission: standard contractual clauses
- California: approved privacy regulations
- California: rulemaking status and effective date
- HHS: business associate contract provisions
Frequently Asked Questions
Create your AI Data Processing Addendum (DPA) in minutes.
Answer a few questions and download a clear, attorney-drafted document that cites the controlling law and is ready to sign.