Data processor and DPA
The vendor that processes personal data on your company’s behalf (such as a cloud AI service) and the mandatory contract governing that relationship.
When your company uses an external service that processes personal data on your instructions (an AI tool, a cloud CRM, a payroll provider), that vendor is a data processor. Your company remains the controller.
GDPR Article 28 requires a data processing agreement (DPA) setting out, among other things: that it will only process data on your instructions, confidentiality, security measures, use of sub-processors, help with data subject rights and return or deletion at the end.
In AI one clause is especially important: that the vendor does not use your data to train its models. If it does so for its own purposes, it stops being a processor for that use and things get complicated.
Reference: Art. 28 RGPD
Related terms
Take the free assessment and find out in a few minutes which obligations your company has and where to start.
← Back to the glossaryUpdated: October 2026 · Informational content, not legal advice.