How to draft a Data Processing Agreement (DPA) with AI

The steps

1. 1.

   Identification of the parties and qualification of roles

   The first step involves the precise identification of the Controller and the Processor, verifying that the nature of the service actually entails processing on behalf of a third party. Pursuant to Art. 28, par. 1, GDPR, it is necessary to ensure that the processor provides sufficient guarantees to implement appropriate technical and organizational measures. It is essential that the agreement is linked to the main service contract, of which it constitutes an inseparable technical annex. The qualification must be unambiguous: if the provider independently determines the purposes and means, they cannot be designated as a processor under Art. 28 GDPR.

2. 2.

   Defining the scope and processing details

   The act must analytically specify the contents required by paragraph 3 of Art. 28 GDPR, avoiding generic descriptions or vague references. It is necessary to precisely list the categories of data processed, such as personal identifiers, personal data relating to criminal convictions and offences, or health data, and the categories of data subjects, such as employees, customers, or web users. The duration of the processing must be consistent with the provision of the main service and must provide for the fate of the data upon termination of the relationship. An incomplete mapping of these elements leads to the unlawfulness of the processing and the imposition of administrative fines under Union law.

3. 3.

   Structuring documented instructions

   The Processor is obliged to process personal data only on documented instructions from the Controller, including transfers to third countries. Such instructions must be integrated into the agreement or provided subsequently in writing, ensuring the traceability of every processing operation. It is necessary to insert a clause requiring the processor to immediately inform the controller if an instruction violates the GDPR or other national provisions. Without a clear flow of instructions, the processor acts outside the scope of legitimacy, assuming the status of a controller with the relative civil and sanctioning liabilities.

4. 4.

   Implementation of security measures

   The agreement must bind the processor to comply with Art. 32 GDPR, requiring the adoption of technical and organizational measures appropriate to the identified risk. These include pseudonymization, encryption, the ability to ensure confidentiality and system resilience, as well as procedures for regularly testing the effectiveness of the measures. A generic reference to the law is not sufficient: measures should be described in a specific technical annex that the processor commits to maintaining. The Controller must retain the right to verify the adequacy of such measures through periodic audits and inspections conducted directly or by appointed third parties.

5. 5.

   Regulation of sub-processing and assistance

   The use of a sub-processor requires written authorization, specific or general, from the controller, according to the conditions set out in Art. 28 par. 2 and 4. In the case of general authorization, the processor must inform the controller of any changes regarding the addition or replacement of sub-processors, granting the right to object. The contract must also provide for the processor's obligation to assist the controller in responding to data subjects' requests for the exercise of their rights. This cooperation is vital to ensure that the controller can fulfill its legal obligations within the strict deadlines provided by the regulation.

Legal basis: art. 28 Reg. UE 2016/679 (GDPR)art. 32 Reg. UE 2016/679 (GDPR)