Checking an AI supplier's data processing agreement
By Keith Hamilton · · 4 min read
An AI data processing agreement is the written contract UK GDPR requires between you and an AI supplier that handles personal data on your behalf. When an AI tool processes your customers' or staff's personal data, the supplier is normally your processor, and this agreement is where its obligations are set down. It is easy to accept it with a click and never read it. This guide explains what an AI supplier's DPA must cover under UK GDPR, the questions that matter most for AI tools, and what to do when the terms fall short. It is practical guidance, not legal advice.
Who is responsible for what under UK GDPR?
The business that decides why and how personal data is used is the controller, and a supplier that handles the data only on the controller's instructions is a processor. When you use an AI tool to draft replies, summarise calls or sort enquiries, you are normally the controller and the supplier is your processor.
That matters because you stay responsible. A supplier saying it is "GDPR compliant" does not move that responsibility to them. The agreement is where its promises to look after the data are written down.
AI brings one twist. Some suppliers use customer data for their own purposes, such as improving their models. For that use, they may be acting as a controller in their own right rather than as your processor, which is a different relationship and needs a closer look before you agree to it.
What must an AI data processing agreement cover?
An AI data processing agreement must include the terms UK GDPR sets out for any contract with a processor. In plain English, the supplier agrees to:
- process your data only on your documented instructions
- make sure its staff are bound by confidentiality
- keep the data secure with appropriate technical and organisational measures
- use other companies (sub-processors) only with your permission, and pass on the same obligations to them
- help you respond when people exercise their data protection rights, such as asking for a copy of their data
- help you with security, breach notification and data protection impact assessments
- delete or return your data when the service ends
- give you the information you need to show compliance, and allow audits or inspections
If a supplier's agreement does not cover these points, or you cannot find an agreement at all, stop and ask before any real personal data goes in.
What questions matter most when checking an AI supplier?
The questions that matter most are about training, retention, sub-processors, data location and breaches. An agreement can tick every box above and still leave these unanswered, so look for clear answers on each.
Does the AI train on my data?
Settle this first: find out whether your inputs and outputs are used to train or improve the supplier's models. Check whether training is the default on your plan, and how to switch it off. Get the answer in writing.
How long are prompts, outputs and logs kept?
Retention periods vary by supplier, so ask for each one in writing. Many AI services keep conversation history, files and logs, in some cases for safety monitoring, and some allow their staff to review conversations. Ask how long each is kept, who can read it, and how deletion works.
Who are the AI sub-processors?
AI sub-processors are the other companies your supplier relies on to deliver the service. Many AI products are built on another company's model, hosted in someone else's data centre. Ask for the list of sub-processors, what each one does, and how you will be told about changes. You should have a chance to object to a new one.
Where is the data processed?
Ask the supplier to name the countries where your data is processed and the safeguard that covers each transfer. If personal data leaves the UK, there must be appropriate safeguards for the transfer. Depending on the destination, that rests on UK adequacy regulations, or on contract terms such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. A good supplier tells you which applies without hesitation.
What happens if something goes wrong?
The agreement must require the supplier to tell you about a personal data breach without undue delay. If a breach is reportable, you have to tell the ICO within 72 hours of becoming aware of it, so a supplier that takes weeks to tell you leaves you exposed.
Are free and business AI plans covered by the same terms?
No. The terms behind a free or personal plan are frequently different from those behind a business or enterprise plan. A data processing agreement is regularly only available on business plans, and training settings differ too.
Check which plan your team is actually using. If staff are on personal accounts, the agreement you have read does not cover them. Our guide to writing an AI policy explains how to set rules on approved tools and accounts.
What are the warning signs in AI vendor due diligence?
The clearest warning sign is a supplier that cannot answer basic questions about your data. Take extra care if a supplier:
- cannot point you to a data processing agreement
- cannot say where your data is processed
- uses your data for training by default with no way to opt out on your plan
- does not publish its sub-processors or tell you about changes
- can change its terms without telling you
None of these automatically rules a supplier out, but each needs a satisfactory answer before personal data goes in.
What records should you keep?
Keep a copy of the agreement you accepted, with the date and the plan it applies to. Note the settings you checked, such as training and retention, and the answers the supplier gave to your questions. Review it at renewal, because AI suppliers update their terms regularly.
Our UK GDPR and AI checklist covers the rest of the routine, including lawful basis, privacy information and impact assessments. If the tool is high risk or the terms are unusual, take advice from a data protection specialist or a lawyer.
Where Forwardcycle fits
Vendor due diligence is part of our safe adoption service. The AI Governance Pack includes a vendor checklist, alongside an AI policy, data protection impact assessment and staff guidance, so you know what to ask before you sign. To see where you stand today, take the free AI Readiness Assessment.