Data processing agreements for AI services: what must be in them, and what ChatGPT lacks
Short answer
As soon as an AI service processes personal data for you, the vendor is a processor and Article 28 GDPR requires a written contract. It must cover subject matter, duration, data types, instructions, confidentiality, security, sub-processors, deletion and audit rights. A personal or Plus ChatGPT account has no such contract; Business, Enterprise and the API offer one. What matters is what the contract says about training, storage location and sub-processors.
When a DPA is mandatory
Article 28 GDPR applies as soon as a service provider processes personal data on your behalf. With an AI service that is almost always the case: an employee types a customer name into a prompt, uploads an email or has a meeting report summarised. The vendor then processes that data on its servers, and without a contract there is no legal basis for the transfer. This is not a formality: the transfer without a DPA is a breach in itself, whether or not anything goes wrong.
The exception is a service that works exclusively with data that is not personal. In practice that is hard to guarantee. See Is ChatGPT GDPR-compliant? for the difference between personal and business use.
What Article 28(3) requires
| Required term | What to look for with an AI service |
|---|---|
| Subject matter, duration, nature and purpose | Does it say “providing the service” or also “improving the models”? The latter is training on your data. |
| Data types and data subjects | Broadly worded for generative AI; check whether special categories (health, employees) are excluded. |
| Processing on instructions | The vendor processes only on your documented instructions. A reservation such as “we review content for abuse detection” is processing of its own. |
| Confidentiality | Who at the vendor can read prompts, and under which obligation. |
| Security (Article 32) | Encryption, access control, logging. Certificates do not replace a description of the measures. |
| Sub-processors | A list with names and locations, plus your right to object to changes. With US vendors this is often the parent company itself. |
| Help with data subject rights and breach notification | How fast does the vendor report a breach? “Without undue delay” with no deadline is not enough. |
| Deletion or return | What happens to prompts, files and conversations after the contract ends, and after how many days. |
| Evidence and audits | An audit right, or at least reports you can show your supervisory authority. |
How ChatGPT, Copilot and others compare
- ChatGPT Free and Plus are consumer products. There is no DPA, input may be used for training by default, and the account belongs to the person, not the organisation. Unsuitable for personal data.
- ChatGPT Business, Enterprise and the API: OpenAI offers a Data Processing Addendum for these, concluded on request, which excludes training. Check storage location, retention periods and the sub-processor list; processing still takes place at a US company.
- Microsoft 365 Copilot falls under the existing Microsoft product terms and the Data Protection Addendum. The question is less whether a DPA exists than which data Copilot may reach inside the tenant.
- Smaller SaaS tools with an “AI feature” often pass your data on to a model provider. Then you need the sub-processor chain all the way to the model.
A signed DPA does not automatically make a service suitable. It is the precondition for being able to assess it at all. For the questions to put to the vendor, see Assessing an AI vendor; for the location question, The CLOUD Act and European data.
A six-question checklist
- Training excluded? Explicitly, for every product tier your staff use.
- Where is the data? Storage and processing location, including support access from third countries.
- Who are the sub-processors? Names, locations, advance notice of changes.
- How long is a prompt kept? Look separately at operational data, logs and abuse review.
- What is the breach notification deadline? In hours, so you can meet your own 72 hours.
- What happens on exit? Export, deletion confirmation, deadline.
Record the answers in your record of processing activities and in the DPIA for generative AI. That is the file your supervisory authority wants to see.
When no DPA is needed
A DPA governs transfer to a third party. If the model runs on a node that belongs to your organisation, there is no third party: prompts, documents and answers never leave the building. The contract with the model provider disappears, and with it the questions about training, storage location and sub-processors. If a service provider operates the node, you need a DPA with them; it is short, because it covers operations rather than content.
How werqly fits in
werqly runs on a node of your own in your organisation’s server room, or as a dedicated node in a European data centre, with open-weight models that send nothing to a model provider. If you operate the node yourself, no DPA is needed for the AI. If werqly operates it, you sign a DPA with werqly that is limited to operations. werqly AI Control logs who asked what, as evidence for the supervisory authority.
Frequently asked questions
Questions on this topic
Does ChatGPT have a data processing agreement?
For ChatGPT Business, Enterprise and the API, OpenAI offers a Data Processing Addendum that you must actively conclude. For Free and Plus accounts there is no DPA; they may not be used to process personal data.
Is a DPA enough to use an AI service in line with the GDPR?
No. The DPA is the precondition. You also need a legal basis, an assessment of the transfer outside the EU, usually a DPIA, and internal rules on which data may be entered.
What is the biggest risk in AI DPAs?
Wording that lets the vendor use the data for its own purposes: model improvement, quality assurance, abuse detection by reading content. For that part the vendor is no longer a processor but a controller, and your contract does not cover it.
Do I need a DPA for AI in my own server room?
Not for the model, because no third party receives data. Only if a service provider operates the server and could access data in doing so do you need a DPA with them for the operations.
Sources
- GDPR, Article 28 Processor (EUR-Lex)
- European Commission — Standard contractual clauses for controllers and processors
- OpenAI — Data Processing Addendum
This article is general information, not legal advice. Rules and guidance change; check the sources listed or ask your lawyer or DPO if in doubt.