The data processing agreement (DPA) is often treated as an accessory to the privacy policy: the policy faces users, the DPA faces suppliers, and both having been written is taken as compliance. The actual function of a DPA is different — it determines the legal character of the processing relationship. Between an AI product and its model provider, API supplier or outsourced service desk, who processes, for what purpose and who answers for failure are all settled by this contract. Characterise the relationship wrongly and the allocation of liability and the regulatory analysis will follow it.
1. Three relationships, distinguished first
Processing on instruction. The processor acts on the controller’s instructions and may not change the purpose or method. Where the product company determines purpose and method and the model provider executes on parameters, the relationship is processing on instruction. The model provider may not use user input to improve its own model; doing so exceeds the scope of the instruction.
Joint processing. Two or more processors jointly determine purpose and method. This appears in joint operations, co-developed models and joint ventures. Two conditions must both be met: purpose and method are jointly determined. Sharing data alone is not enough.
Independent processing. Each party determines its own purpose and method. The typical case is an integrated SDK collecting device information for its own analytics; that is independent processing, a DPA does not apply, and disclosure in the privacy policy is the right instrument.
The order of analysis is: who determines purpose and method, whether that is done jointly, and whether either party acts independently. Most AI relationships fall into processing on instruction, but two mischaracterisations recur — treating independent processing as entrustment in the SDK case, and treating entrustment as independent processing where the model provider is in fact using data to improve its model.
2. Nine clauses a processing DPA needs
1. Scope and instructions. State the purpose, categories, method and retention period, and provide that the processor acts only on written instructions.
2. Sub-processor controls. Where the model provider engages downstream suppliers, prior written consent is required and equivalent obligations must flow down. Liability on the chain does not disappear through subcontracting.
3. Security obligations. Implement technical and organisational measures proportionate to risk — encryption, access control, audit, confidentiality undertakings. The clause should set minimum standards rather than refer only to reasonable measures.
4. Assistance. The processor assists the controller with data-subject requests, notice duties, deletion and regulator communications. The scope and time limits of that assistance should be specified.
5. Cross-border processing. Where the processor or a sub-processor processes abroad, state the mechanism relied on — security assessment, standard contract or certification — and allocate the corresponding obligations.
6. Retention and deletion. On termination or on request, delete or return the information and certify deletion. The scope of deletion covering training data, logs and backups should be addressed separately.
7. Audit and inspection. The controller may inspect the processor’s activities within a reasonable scope, including reviewing certifications, requesting processing records and, where necessary, conducting an on-site review. A supplier that will not accept an audit clause is generally not worth trusting.
8. Breach and indemnity. Distinguish losses caused by breach of the DPA from third-party claims arising out of processing, and allocate each. The controller indemnifies the processor for liabilities arising from processing on instruction; the processor indemnifies the controller for liabilities arising from acting outside instructions or breaching security.
9. Duration and survival. State the term, the obligations that survive termination — deletion, confidentiality, assistance — and how the terms may be varied.
3. Three ways to draft cross-border clauses
| Situation | Drafting approach |
|---|---|
| Domestic product calling an overseas model API | State the fact of transfer and the basis — standard contract or security assessment; identify the overseas recipient |
| Domestic processor engaging an overseas sub-processor | Maintain a live sub-processor list; map the transfer mechanism at each layer |
| Overseas product calling a domestic model | The domestic party acts as processor; the overseas controller must satisfy transfer requirements, and obligations shift with the direction of the relationship |
The most common error is a single sentence that the parties shall comply with applicable data protection law. Regulatory practice expects four answers: who transfers to whom, what is transferred, on which channel, and what the recipient must do.
4. Joint and independent processing: different instruments
Joint processing calls for a separate joint-processing arrangement: the scope of each party’s responsibility, the division of responsibility towards data subjects, and the representative and notification mechanism as against the outside world. Independent processing does not use a DPA; instead the privacy policy discloses the SDK and the interface is made compliant with the SDK provider’s own notice and consent duties.
All three share one requirement: evidence. Contracts, sub-processor lists, deletion certificates and audit records form the factual chain of the processing relationship, which regulators verify layer by layer.
5. Relationship with the master agreement and the privacy policy
The DPA should state its relationship with the master services agreement: the master agreement covers services and fees, the DPA covers data processing, the DPA prevails in case of conflict, and the DPA forms part of the master agreement and takes effect and terminates with it. The privacy policy faces users and the DPA faces suppliers; both describe the same processing activity from different sides, so purpose and categories must match. If they do not, cross-checking will expose the discrepancy.
6. Annual compliance checklist
| No. | Item | Pass standard |
|---|---|---|
| 1 | Characterisation | Each DPA mapped to a clear relationship |
| 2 | Scope | Consistent with the privacy policy and the PIA |
| 3 | Sub-processor list | Current, complete, all consented in writing |
| 4 | Transfer mechanism | Basis for each transfer; recipient obligations clear |
| 5 | Security | Supplier holds a valid certification; no material incident |
| 6 | Deletion | Executable on termination and on request; certificates held |
| 7 | Audit records | Annual review completed and retained |
| 8 | Model improvement | Confirmed that the processor does not use input for its own model |
| 9 | Change linkage | DPAs updated after supplier changes; policy aligned |
| 10 | Incident reporting | Written escalation and resolution records exist |
Item 8 deserves separate verification in AI contexts. Where a model provider’s terms permit it to use customer data to improve its model, the actual conduct constitutes independent processing outside the instruction even if the DPA says otherwise; the relationship must be recharacterised and the consent basis re-established.
The maturity of a DPA reflects the maturity of a company’s processing-relationship governance. Only a company that can characterise every relationship and make every DPA executable has a coherent account to give a regulator.
Related reading: the core contract set for AI companies, privacy policies for AI products, personal information protection impact assessment, GDPR and cross-border data transfers, and the data compliance and commercial contracts service pages.
Last updated: 6 August 2026.
Frequently Asked Questions
How do entrusted and joint processing differ?
The test is whether each party independently determines the purpose and means. A party acting only on instructions is an entrusted processor; joint determination is joint processing, with different liability allocation and notice duties.
Which clauses are essential in a DPA?
Purpose and scope, duration, processing method, security measures, sub-processors, assistance obligations, deletion and return, audit rights, incident notification and liability.
What are the three cross-border drafting options?
No transfer; transfer with the route and conditions stated; transfer subject to separate consent. Choose according to the actual data flow rather than a generic 'may be transferred'.
What if the DPA conflicts with the main agreement?
State that the DPA prevails, so that security duties and liability caps are not overridden by general clauses in the main agreement.
What if the supplier refuses an audit?
Substitute questionnaires and third-party reports, but retain incident cooperation and, where necessary, on-site inspection. That floor should not be conceded entirely.
How should performance be reviewed?
Annually check the processing scope, sub-processor list, security incident records, deletion certificates and training records, and record a written conclusion.