ZetrixwebThe baseline requirements
Under Article 28 of the GDPR, processing by a processor must be governed by a contract that, among other things, requires the processor to act only on your documented instructions, ensure confidentiality, apply appropriate security measures, engage subprocessors only with authorization, assist with data subject requests and security obligations, delete or return data at the end of the service, and allow audits. Make sure you have identified your role and the vendor's correctly, since some vendors act as independent controllers for part of the processing.
These terms are usually in a standard data processing addendum. Check that it is signed, current, and covers the specific product and plan you actually use.
The AI-specific questions
Is customer data used to train or improve models, and can you opt out contractually? How long are prompts and outputs retained, including for abuse monitoring, and can retention be reduced or disabled? Where is data processed and stored, and which subprocessors are involved in inference and support? How are model changes and deprecations communicated? Who at the vendor can access your data and under what conditions?
Ask about security evidence, deletion on request, incident notification timelines, and support for data subject rights across stored prompts and logs.
| Question | Why it matters | Evidence to request |
|---|---|---|
| Training use | Your data may shape future models | Contract clause or documented policy |
| Retention | Prompts may be stored for weeks or longer | Retention schedule and controls |
| Location | Drives transfer analysis | Processing and storage regions |
| Subprocessors | More parties handle your data | Current subprocessor list and notice process |
| Security | Protects against breaches | Independent reports and certifications |
International transfers and recordkeeping
If data leaves the European Economic Area, you need a valid transfer mechanism, such as an adequacy decision or standard contractual clauses, plus any supplementary measures your assessment requires. Keep the agreement, subprocessor list, and your assessment on file and update your records of processing.
Remember the vendor's compliance is also part of your AI supply chain, which matters for AI Act obligations. Our article on general-purpose AI enforcement covers that side.
Reviewing AI vendors for GDPR compliance? Talk to us about a vendor review.
Key takeaways
- Article 28 requires a contract with documented instructions, confidentiality, security, subprocessor control, assistance, deletion, and audit rights.
- Confirm roles and that the agreement covers the plan you actually use.
- Ask AI-specific questions on training use, retention, location, subprocessors, and model changes.
- Handle international transfers properly and keep documents and records current.