Data processing agreements with AI providers: what to look for in the contract

When do you need a DPA with the AI provider?

Whenever the provider processes personal data on your behalf: it runs the platform, the AI model or both, and you decide what for. With cloud offerings, this is the rule. A DPA can also be needed for a server on your premises, for example if the provider takes over operation or accesses data for support. Without access to personal data, the provider is not a processor.

If the provider uses your data for its own purposes, such as training its models, it goes beyond its role: for that purpose it becomes a controller itself (Art. 28(10) GDPR) and needs its own legal basis. The German Data Protection Conference (DSK) therefore considers offerings preferable that do not use inputs and outputs for training.

What must a DPA contain under Art. 28(3) GDPR?

Content	Art. 28(3)	What to look for with AI
Subject matter, duration, nature and purpose, types of data, data subjects	sentence 1	Name the use of AI specifically, including uploaded documents and logs
Processing only on instructions	point (a)	No training, no product improvement with your data
Confidentiality of staff	point (b)	For professional secrecy, § 203 StGB in addition
Security under Art. 32	point (c)	TOMs as an annex, encryption, permissions, logs
Sub-processors	point (d), paras. 2 and 4	List with location and service, including for AI model inference; right to object to changes
Support with data subject rights	point (e)	Access, erasure, rectification, also for chats and documents
Support with Art. 32 to 36	point (f)	Reporting data breaches, information for your DPIA
Deletion or return at the end	point (g)	Deadlines for export, deletion, backups
Proof and audits	point (h)	Certificates, attestations, right to on-site audits

Which AI-specific points also belong in it?

• Training: explicitly excluded, including for sub-processors that provide models.
• Storage of inputs: whether and for how long the provider or the model provider stores inputs and answers, for example for abuse detection. Why waiving storage alone is not enough: Zero Data Retention: is it enough?
• Location of inference: in which data centre the AI model runs and whether a provider outside the EU is involved. For transfers to third countries, standard contractual clauses (2021/914) or an adequacy decision are added.
• Change of model: whether a change of model or model provider counts as a change of sub-processors.
• Logs: what is logged, who sees it, how long it is kept.
• Requests from authorities: how the provider handles demands for disclosure and whether it informs you.

What applies to professional secrecy holders?

Under § 203(3) and (4) StGB (German Criminal Code), doctors, psychotherapists and other professional secrecy holders may only disclose secrets to service providers to the extent necessary and if the service provider has been bound to confidentiality. The DPA alone does not cover this; an additional agreement that informs about criminal liability is common practice. More on this: § 203 StGB and service providers.

How do you check a DPA in practice?

1. Clarify roles: is the provider a processor, and for which parts not?
2. Tick off the required content under Art. 28(3).
3. Read the list of sub-processors: who runs the AI model, and where?
4. Check the TOMs against your level of protection.
5. Assess links to third countries and the US CLOUD Act (US CLOUD Act and AI).
6. Where needed, additional agreements: § 203 StGB, church data protection law, social data.

How does this work with basebox?

The data processing agreement under Art. 28 GDPR is automatically part of every contract, currently in the version of 8 October 2026. If data is transferred to a country outside the EU, the European Commission’s standard contractual clauses are added. basebox processes only on your instructions, uses sub-processors only with your authorisation, informs you in advance of changes, to which you can object, and reports breaches of the protection of your data without undue delay. Your data does not train any model; basebox only uses service providers that provide AI models if their contract excludes training with the data transferred. For professional secrecy holders, the agreement under § 203 StGB applies as an annex to the licence agreement. basebox also reviews your own DPA template. The DPA, the list of sub-processors and the agreement under § 203 StGB are available for download.

Not legal advice: This article does not replace a review of your contract by your data protection officer or your legal department. The version agreed in your contract is decisive. Research as of: 11 October 2026.