What is a data processing agreement?
A data processing agreement (DPA) is a contract between a company that decides why and how personal data is used (the controller) and a vendor that handles that data on its behalf (the processor). It sets out what the vendor may do with the data, how it must protect it, which other companies it may pass the data to, and what happens to the data when the relationship ends. Many vendors call the same document a data processing addendum, because it is attached to the main service agreement.
Under the EU General Data Protection Regulation (GDPR), a DPA is not optional. Article 28 says processing by a processor must be governed by a binding contract, and lists what that contract has to contain. The UK GDPR carries the same rule, and US state privacy laws such as the California Consumer Privacy Act require similar service provider contracts.
For an AI customer support agent, the DPA is where a security or legal team checks the questions that matter most: where conversation data is hosted, which model providers see it, whether it is used for training, and how the vendor tells you before anything changes.
What a DPA must contain under GDPR Article 28
Article 28(3) lists the minimum terms. A compliant DPA describes the subject matter and duration of the processing, its nature and purpose, the types of personal data and the categories of data subjects, and the obligations and rights of the controller. It then binds the processor to a set of duties:
Process personal data only on the documented instructions of the controller, including for international transfers.
Make sure the people who handle the data are bound by confidentiality.
Apply the security measures required by Article 32, such as encryption and access control.
Engage other processors, known as subprocessors, only with the controller's prior written authorisation, and flow the same data protection obligations down to them.
Help the controller respond to data subject requests and meet its own security, breach notification and impact assessment duties.
Delete or return all personal data at the end of the service, unless law requires it to be kept.
Make available the information needed to demonstrate compliance, and allow for audits and inspections.
DPA, SCCs and international transfers
A DPA governs the relationship. It does not by itself make a transfer of EU personal data to another country lawful. When data leaves the European Economic Area, the DPA usually incorporates a transfer mechanism: the European Commission's Standard Contractual Clauses (SCCs), adopted in their current form in June 2021, or, for certified US companies, the EU-US Data Privacy Framework that the Commission recognised in July 2023.
This is why buyers ask about data residency in the same conversation as the DPA. If a vendor can host and process your data inside the EU, fewer transfers need a mechanism in the first place.
Why a DPA matters for AI customer support
Support conversations are full of personal data: names, email addresses, order details, account information, and sometimes payment or health details a customer types into chat without being asked. An AI agent reads that data, sends parts of it to a language model to generate a reply, and may call tools in your billing system or CRM. Each step is processing, and each one should be covered by the DPA.
The AI layer adds questions that older SaaS DPAs did not need to answer:
Model providers. Which language model providers receive conversation data, and are they listed as subprocessors?
Training. Does the vendor, or its model providers, use your customers' data to train or improve models?
Region of inference. Hosting data in the EU helps less if every prompt is sent to a model endpoint in another region.
Logs and traces. How long are conversation logs, tool call records and audit trails kept, and are they deleted at the end of the contract?
Change control. How much notice do you get before a new subprocessor starts handling your data, and can you object?
How to review a DPA from an AI support vendor
A practical review takes the Article 28 list as the floor and then checks five things against the vendor's other documents. First, compare the subprocessor list in the DPA with the vendor's public subprocessor page and trust center; they should match. Second, confirm the hosting region and the model endpoint region for your account. Third, find the no-training commitment in writing, not only in marketing copy. Fourth, check breach notification timing and who you will hear from. Fifth, read the end-of-contract clause so you know how conversation history and knowledge content are returned or deleted, which also limits vendor lock-in.
How Fini handles the DPA
Fini publishes its Data Processing Addendum and its current subprocessor list. Customers choose a designated hosting region, US or EU, and Fini routes model traffic to endpoints in, or nearest to, that region where such endpoints are available. Language model providers process customer data under enterprise agreements, and the DPA states that customer data is not used to train their models. Fini gives at least thirty days' notice before a new subprocessor processes customer data, and customers can object on reasonable grounds within fifteen days.
Walk through Fini's DPA, hosting region and subprocessors with the team. Book a call.
Frequently asked questions
What does DPA stand for?
DPA stands for data processing agreement, also called a data processing addendum. It is the contract a company signs with a vendor that handles personal data on its behalf, setting out what the vendor may do with that data and how it must protect it.
Is a DPA required under GDPR?
Yes, when a controller uses a processor. GDPR Article 28(3) requires processing by a processor to be governed by a contract or other legal act that is binding on the processor and sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.
What is the difference between a DPA and a BAA?
A DPA is the GDPR instrument between a controller and a processor of personal data. A business associate agreement (BAA) is the HIPAA instrument between a covered entity and a business associate handling protected health information. A healthcare company using an AI support vendor in the EU and US may need both.
What should a DPA with an AI support vendor cover?
Beyond the Article 28 basics, check where data is hosted and which region the model endpoints run in, whether customer data is used to train models, the current subprocessor list and how changes are notified, breach notification timing, and what happens to conversation logs and knowledge content when the contract ends.
Who signs the DPA, the customer or the vendor?
Both. The customer, acting as controller, and the vendor, acting as processor, sign it. Most software vendors publish a standard DPA that customers accept with the main agreement, and larger buyers often negotiate specific clauses such as audit rights or region commitments.