Data protection · Business AI
AI DPA Compliance Guide: 10 Providers and the Checks That Matter
Find the right processing agreement for your actual AI service—and connect it to the way your business pipeline handles data.
A Data Processing Agreement (DPA) is part of the operating design, not a badge that makes an AI system compliant. Where a supplier processes personal data on your behalf as a processor, Article 28 GDPR requires an appropriate binding contract or other legal act. The controller remains responsible for the purpose, lawful basis, transparency and other obligations that apply to its processing.
This guide is a practical contract-review starting point, not an assessment of your individual deployment. Provider documents and optional services change. Match the current terms to the product, account, region and contracting chain you actually use. Keep a copy of the applicable documents and record who checked them.
1. OpenAI
The published OpenAI DPA states that it supplements and is incorporated into the services agreement and governs processing of customer data on the customer’s behalf. Its current opening terms describe acceptance through agreement, an order form or use of the services.
What to verify
Identify the contracting entity, the covered business service and the version that applies to your account. Check the service’s data controls, retention and regional processing separately. Do not apply consumer-chat settings to an API or business contract by assumption.
2. Anthropic
Anthropic’s published DPA says it forms part of its Commercial Terms of Service or another agreement that references the DPA. It applies to the processing of customer data described in that agreement.
What to verify
Confirm whether you are contracting directly with Anthropic or accessing a model through another platform. Retain the actual applicable agreement. Check retention, subprocessors and any optional data-handling arrangement for the specific service, not just the model name.
3. Google Cloud and Gemini services
Google publishes a Cloud Data Processing Addendum incorporated into the agreements it identifies. That document is an entry point for reviewing Google Cloud processing, not a single answer for every Google AI product or account type.
What to verify
Distinguish Vertex AI, the Gemini API, Google AI Studio and consumer products. Confirm the agreement, billing/account status, data-use rules and region of the exact service. Do not infer protections from the fact that another Google product has a Cloud DPA.
4. Microsoft Azure
Microsoft’s licensing library publishes the Products and Services Data Protection Addendum in dated versions. Use it with the product terms and service documentation that apply to your Azure or other Microsoft purchase.
What to verify
Retain the relevant version and establish which service features it covers. Check processing locations, subprocessors, logging and connected services. A familiar cloud vendor does not remove the need to map your own prompts, files, identities and downstream actions.
5. Amazon Web Services
AWS provides GDPR guidance and a data processing addendum for applicable customer processing. Cloud controls and customer configuration both matter. For an AI pipeline, review the selected service and deployment rather than treating all AWS workloads as equivalent.
What to verify
Confirm the applicable AWS agreement and DPA, model/service terms, selected region and any cross-region features. Include logs, storage, support access and integrations in the data map. Keep the current contract alongside the configuration evidence.
6. Mistral AI
Mistral’s published DPA forms part of and supplements the service agreement. It defines personal data in relation to the customer data Mistral processes as a processor under that agreement.
What to verify
Separate a hosted API or business product from a model you deploy yourself. Confirm the agreed service, processing description, locations and subprocessors. A provider’s European headquarters does not by itself prove that every data flow stays in the EEA.
7. xAI
Treat the applicable xAI business terms and DPA as a contract check for the exact service you intend to use. This guide does not certify a current signing mechanism, hosting location or retention arrangement for your account.
What to verify
Obtain the current applicable documents directly from the provider and confirm incorporation or execution before sending personal data. Distinguish a business API from consumer access. Do not use an unchecked assumption about model training or data retention as an approval decision.
8. Cohere
Cohere’s Trust Center provides security, subprocessor and document resources. The relevant contractual chain depends on whether you use a directly hosted service, a cloud marketplace offering or a private deployment.
What to verify
Request the applicable DPA and processing description for your actual arrangement. Identify who can access prompts, support material and logs. Private hosting can change the data flows, but it does not automatically eliminate every processor or support-access relationship.
9. IBM
IBM’s DPA entry point links to its terms library. IBM Cloud documentation describes a DPA together with applicable service exhibits, so the general document and the selected service need to be considered together.
What to verify
Retrieve the relevant service description and DPA exhibit through the contract or terms library. Record data categories, purposes, processing locations, retention and the customer responsibilities. Do not substitute a general vendor privacy page for the documents covering the purchased service.
10. Hugging Face
Hugging Face offers hosted, enterprise and model-distribution capabilities. Downloading model files and running your own infrastructure is different from sending inputs to a managed endpoint or another inference provider.
What to verify
Confirm the DPA available under your actual contract and plan, and map each hosted endpoint, inference provider, repository and support route involved. Do not assume that every plan has identical contractual coverage or that self-hosting removes the obligations of your other service providers.
Contract comparison checklist
Compare the same questions for each supplier. A yes/no table saying “GDPR compliant” would conceal the differences between contracts, services and configurations.
| Check | Evidence to keep | Why it matters |
|---|---|---|
| Role and scope | Contracting entities, covered services, processing purposes and instructions. | A DPA for another product or entity may not cover your pipeline. |
| Contract acceptance | Applicable terms, order form or signed agreement and its version/date. | Know how the obligations became binding; not every provider uses a separate signature form. |
| Subprocessors | Current list, change notices and the agreed objection process. | The data path can extend beyond the named supplier. |
| Locations and transfers | Processing locations and applicable transfer safeguards. | EU storage alone does not prove that all access and processing stays in the EEA. |
| Data use and retention | Service-specific training/data-use terms, logging, retention and deletion settings. | “Not used for training” and “not retained” are different claims. |
| Assistance and security | Security measures, incident notification, rights assistance and audit provisions. | The contract must connect to a workable response process. |
| Exit | Return/deletion provisions and a tested offboarding process. | Changing vendors should not leave uncontrolled copies behind. |
Put the agreement into operation
1. Identify the actual parties. A business may be a controller for one activity and a processor for another. If you act for a client, check the instructions and authorisation for your downstream providers. Do not assume every vendor relationship has the same role.
2. Minimise what reaches the model. Remove unnecessary personal data, use synthetic examples for testing and set retention appropriate to the purpose. Account for copies in agent memory, vector databases, exports and logs. A contract does not replace these controls.
3. Check international transfers. Identify the actual access and processing locations, not just the billing address. Where a transfer falls under Chapter V GDPR, assess the relevant mechanism and any necessary additional measures for the circumstances. Obtain specialist review where the position is uncertain.
4. Test rights and incident handling. Trace how to find, correct, export or erase data across the pipeline, subject to applicable exceptions. Set a route for incidents and supplier notices. Assign a responsible person rather than relying on an agent to decide the legal response.
5. Review when the pipeline changes. A new tool, model service, data category, subprocessor or purpose can change the assessment. Keep the inventory, contracts and operating rules aligned instead of treating the DPA as a one-time procurement step.
Primary legal reference: GDPR, especially Articles 5, 6, 28, 32 and Chapter V. Continue with the GDPR AI checklist, agent security and oversight, or an OCI pipeline audit.