Topic guide

DPA for AI vendors: what to actually check before you sign

Independent compliance reference from Janus Compliance. Reviewed by Michael K. Onyekwere, CIPP/E. Last reviewed 2026-10-15. Not legal advice.

Share this DPA for AI vendors: what to actually check before you sign profile:Share on X Bluesky

TL;DR. A DPA for an AI vendor has to cover the same Article 28 ground as any other processor contract, plus four AI-specific concerns: training defaults, retention defaults, subprocessor depth, and EU/UK transfer mechanism. The vendor name on the front page tells you nothing on its own - the answer always lives in which product you bought (API, enterprise tier, consumer plan) and which retention setting is in force.

Why an AI vendor DPA is different

A Data Processing Addendum is the contract Article 28 GDPR requires whenever a controller hands personal data to a processor. The structure is the same for any SaaS vendor: scope, instructions, security, subprocessors, transfers, deletion, audit, breach.

What changes with AI vendors is the surface area the DPA has to cover. Three additions force themselves into every serious review:

Training position. Does the vendor use your inputs and outputs to train models? The commercial defaults of five of the six providers covered here say no, while ElevenLabs uses data from its self-serve plans for training unless the customer opts out. Consumer terms at the same providers often allow training, and they can change: in August 2025 Anthropic changed its consumer terms so that users of Claude Free, Pro and Max choose whether their chats are used to train its models.
Retention default. How long does the vendor keep prompts and outputs after the API call returns? On the commercial API tiers of OpenAI and Anthropic the default is up to 30 days, and Google keeps prompts and outputs on the paid Gemini API for 55 days for abuse monitoring. OpenAI and Anthropic offer Zero Data Retention (ZDR) on approval, and on Google's Gemini Enterprise Agent Platform (formerly Vertex AI) it is reached by meeting a set of conditions. Some enterprise products on Microsoft and Google use customer-controlled storage and answer the question differently.
Subprocessor depth and EU Data Boundary scope. The subprocessor list can include several cloud providers as well as the model provider: OpenAI's list of 14 October 2026, for example, names six cloud infrastructure providers for ChatGPT Enterprise and the API. Anthropic became a Microsoft 365 Copilot subprocessor on 2026-01-07 and is explicitly out of EU Data Boundary scope for that route. Microsoft keeps Anthropic off by default for EU, EFTA and UK tenants, but three Copilot routes outside the boundary are on by default. Bing web search, whose generated queries also fall outside the DPA, is on in every commercial tenant. Flex routing (inferencing at peak demand, eligible EU and EFTA tenants) and Anthropic in Copilot for Word, Excel and PowerPoint (EU, EFTA and UK tenants) are on for tenants created after 25 March 2026. A buyer relying on the EU Data Boundary needs to check the tenant's settings rather than assume EU-only processing.

The DPA is the artifact that pins all three down in writing. Reading it once is not optional for any AI deployment that touches personal data, and a re-read on every major product change is the realistic minimum.

The eight clauses that actually decide the risk

A serious DPA review looks at all standard Article 28 clauses, but the eight below carry most of the AI-specific weight.

1. Scope of processing and instructions

The DPA has to state what the vendor processes on your behalf and that they only process on your documented instructions. With AI products this clause has to expressly cover prompts, outputs, embeddings, attached files, retrieval-augmented context, and tool-call results. A DPA that leaves embeddings or tool-call payloads out of scope creates a gap you cannot rely on for an Article 28 claim.

2. Training position (commercial tier)

At five of the six providers this review covers, the default is contractually no training on customer data through the API or enterprise product. ElevenLabs is the exception: only its Enterprise tier is excluded from training by default, and data from its self-serve plans, including API use under those plans, is used for training unless the customer opts out. The contract clause is what gives a no-training default legal weight; a help-centre page does not. Check that the contract itself, not the marketing site, contains the commitment, and note which document holds it. OpenAI puts it in its Services Agreement, Anthropic in its Commercial Terms, Microsoft in its Product Terms and Google in its Cloud and Workspace service-specific terms, rather than in the DPA. Perplexity has it in its Enterprise and API terms, and its DPA adds that personal data will not be used to train Perplexity's large language models.

The document that holds the commitment also decides how far it reaches. A DPA governs the processing of personal data, so a no-training sentence that appears only in the DPA may not cover prompts and outputs that contain no personal data. Nebius, a provider outside this review, shows the problem in the contract documents for its Token Factory service, all published on 15 September 2026, which belegbar.eu records as contradictory. The Token Factory Supplemental Terms provide that, "Subject to the terms of the DPA", Nebius may use input and output to "train smaller Models used for Speculative Decoding" (the small draft models that speed up responses by proposing text for the main model to check). An annex to the DPA says that, unless Zero Data Retention is enabled, inputs and outputs "may be retained and used solely for the documented speculative-decoding purpose and not for model training or improvement". The same annex says that Token Factory "does not use Customer Content to train, fine-tune or improve models for Nebius or any third party", and the DPA defines Customer Content as "all data processed by Nebius on your behalf", so neither statement is limited to personal data in its wording. The DPA itself, however, "applies when Customer Personal Data is processed".

Clause 20.12 of the Services Agreement gives the DPA first place in a conflict "solely with respect to the processing of Personal Data". It then ranks the order form, the service-specific terms (which include the Supplemental Terms) and the Agreement itself above "the remaining Linked Documents and Documentation", and the Agreement lists the DPA among its Linked Documents. For prompts and outputs without personal data, the training permission is therefore likely to govern, although a buyer could argue that "Subject to the terms of the DPA" brings the annex in. A buyer in that position should switch on Zero Data Retention and ask Nebius to confirm it in writing, use the opt-out in clause 5.4 of the Supplemental Terms from collection and processing "for Speculative Decoding", and, where it can negotiate, put a no-training term in its order form, which ranks above the Supplemental Terms.

3. Training position (consumer or free tiers)

The same vendor will often run a different default at the consumer tier. OpenAI's privacy policy for people in the EEA, the UK and Switzerland (updated 24 August 2026) says it may use the content users provide to improve its services, for example to train the models that power ChatGPT, and that users can choose whether their content is used in this way. Its privacy policy for other regions has said the same since at least November 2023. Anthropic changed its consumer terms in August 2025: users of Claude Free, Pro and Max now choose whether their chats and coding sessions are used to train its models, and existing users had until 8 October 2025 to make that choice. Anthropic may keep the data of users who allow training for up to five years, against 30 days for users who do not. Staff who use a consumer product without an enterprise contract are inside the consumer terms, not the commercial ones. The DPA does not protect them because no DPA applies.

4. Retention defaults and Zero Data Retention

API retention defaults at both OpenAI and Anthropic are up to 30 days. OpenAI retains API abuse-monitoring logs for up to 30 days, and Anthropic's privacy centre, in an article dated 1 July 2026, states that it deletes API inputs and outputs within 30 days of receipt or generation. Both vendors offer ZDR through their commercial sales channel, but ZDR is approval-gated, not on by default. A buyer who needs ZDR has to apply, document the use case, and accept that certain abuse-monitoring exceptions remain.

5. Subprocessor list and change-notice cadence

An AI vendor's subprocessor list can include the model provider, the cloud the model runs on, and providers of content moderation, analytics and security tooling. The DPA should commit to publishing the list, giving notice on additions, and providing an objection mechanism. The terms differ by vendor: OpenAI allows 30 days to object after notice of a change, with a right for either party to terminate if the objection is not resolved; Anthropic gives reasonable notice and 15 days to object, after which the customer is deemed to consent; and Google gives at least 30 days' notice, with a right to terminate within 90 days (OpenAI and Google checked 15 October 2026, Anthropic 4 October 2026).

6. EU/UK transfer mechanism

Where a transfer relies on the Standard Contractual Clauses, the buyer needs the SCCs for EU controller-to-processor transfers, the UK Addendum for exports from the UK, and a Transfer Impact Assessment to support both. Transfers to a US recipient certified under the EU-U.S. Data Privacy Framework rely on the adequacy decision instead and need no TIA. AI vendors should name the SCCs in use (the 2021 set, not the legacy 2010 set), the UK Addendum version, and any EU Data Boundary commitment they make on top. Anthropic's 2026-01 inclusion as a Copilot subprocessor with an explicit EU Data Boundary carve-out shows why the "EU-only" claim from any enterprise vendor needs the carve-outs read line by line.

For a vendor in the United States, check whether it relies on certification under the EU-U.S. Data Privacy Framework (DPF), on the SCCs, or on both, and verify any certification on the official participant list at dataprivacyframework.gov, which shows the status separately for the EU-U.S. framework, the UK Extension and the Swiss-U.S. framework. On 15 October 2026 the list showed Google LLC, Microsoft Corporation and Eleven Labs Inc. (ElevenLabs) as Active under all three. Perplexity AI, Inc. was Active under the EU-U.S. framework and the UK Extension only, with both periods shown as ending on 8 October 2026, a week before the check. OpenAI and Anthropic did not appear on it, active or inactive, so neither is DPF-certified.

7. Security commitments and certifications

The DPA should reference the vendor's security documentation, and the buyer should pull the documents named. SOC 2 Type 2 and ISO/IEC 27001 are a reasonable minimum to ask for, and the buyer should check which products each certification covers. Of the six vendors on this page, all except Perplexity display ISO/IEC 42001 (AI management system) certification on their trust or compliance pages (checked between 4 and 15 October 2026). A DPA that names a certification the vendor has not actually maintained is a flag worth raising in writing before signature.

8. Deletion and return at end of contract

Article 28(3)(g) requires deletion or return at the controller's choice. With AI vendors the practical question is whether deletion applies to model artifacts that may have been built from the customer's data on enterprise tiers with fine-tuning or retrieval augmentation. A buyer who fine-tuned should ask for written confirmation that the fine-tuned model is deleted as well as the underlying training data.

How the six vendors line up on the DPA basics

The full review for each vendor lives in the dedicated profile. The table below is the at-a-glance read for buyers triaging multiple products in one procurement window.

| Vendor | Commercial training default | API retention default | ZDR available | Profile | |---|---|---|---|---| | OpenAI | No (API/Enterprise) | Up to 30 days (abuse-monitoring logs) | Yes, approval-gated | OpenAI | | Anthropic | No (API/Team/Enterprise) | Up to 30 days | Yes, approval-gated | Anthropic | | Microsoft 365 Copilot | No (tenant-bound) | Tenant-controlled | N/A (tenant model) | Microsoft 365 Copilot | | Google Gemini (Workspace) | No (Workspace Service Specific Terms, s 12.11) | Set by admins: Gemini in Workspace prompts and responses 90 days to indefinite, Gemini app up to 36 months (default 18 months). Set by Google: up to 72 hours for Gemini app chats with conversation history off, and up to 18 months for feedback | N/A (workspace model) | Google Gemini | | Perplexity | No (Enterprise and API terms) | Not published for the API (Perplexity says retention varies by API, model and account configuration), and files attached to Enterprise sessions are deleted after seven days | API: for eligible customers under a written agreement, not on by default. Enterprise: no customer option published | Perplexity | | ElevenLabs | No on Enterprise only. Self-serve plans, including API use, are used for training unless the customer opts out, and the opt-out covers only future data | Retained by default on every tier (history preservation is on), with backups kept for up to 30 days after deletion | Zero Retention Mode for select Enterprise customers' API traffic only, not for voice cloning, dubbing, music or Studio | ElevenLabs |

Commercial defaults are protective at five of the six vendors, and at ElevenLabs only the Enterprise tier is. Consumer defaults often are not protective. The tenant-bound enterprise products (Copilot and Gemini in Workspace) push retention into the buyer's own Microsoft or Google environment rather than holding it at the AI vendor, although Google keeps some Gemini data for its own set periods: Gemini app chats for up to 72 hours when conversation history is off, and user feedback for up to 18 months.

The DPA review steps for a procurement gate

The version below assumes the buyer has a procurement gate to clear and a DPO or compliance owner who has to sign off.

Confirm which product the staff or app will actually use. Commercial API, enterprise SaaS tenant, or consumer free / Pro / Max plan. The DPA only covers what the buyer actually contracted for.
Pull the live DPA from the vendor's portal. Do not rely on the marketing version of the page. Note the version number and date.
Read clauses 1-8 above against the buyer's deployment. Flag any clause whose scope does not match what the staff will actually do with the product.
Cross-check the subprocessor list against EU Data Boundary expectations. If the buyer needs EU-only processing, every subprocessor has to be inside that scope or have a documented carve-out the buyer can accept.
Decide on ZDR or extended retention. ZDR is the cleaner default for any deployment touching special-category data. At OpenAI and Anthropic it is subject to the vendor's approval through the sales team, so the timetable should allow for that step.
Document the transfer mechanism. Where transfers rely on the SCCs, the gate needs all three of the SCC version, the UK Addendum status and a Transfer Impact Assessment on file. The DPA may name only the first, so check where the other two are recorded. Transfers to a DPF-certified US recipient rely on the adequacy decision and need no TIA, so for a US vendor record whether it relies on DPF certification, the SCCs or both, with the date on which you checked its status on dataprivacyframework.gov.
Record the consumer-tier exposure. If staff might use the free consumer product alongside the contracted enterprise tool, the DPO needs a written policy on which is permitted. The default at the consumer tier is what governs, and that default is not always protective.

When the DPA is not enough

A DPA covers processor obligations. It does not cover the AI-specific risks that arise upstream:

The DPIA the buyer owes under Article 35 for the deployment itself
The AI Act role assessment (provider, deployer, distributor) for any system that touches the EU market
The buyer's own data-mapping for what categories of personal data the deployment ingests
The retention policy the buyer applies on its own side, regardless of the vendor's retention default

The DPA pins the vendor down. The DPIA and the AI Act role assessment pin the buyer down. Both have to be complete before the procurement gate closes.