AI DATA PROCESSING AGREEMENT

AGREEMENT DATE: [DATE]

AGREEMENT NUMBER: [DPA-NUMBER]

PARTIES

DATA CONTROLLER ("Controller"):
- Legal Name: [CONTROLLER LEGAL NAME]
- Address: [FULL ADDRESS]
- Contact: [NAME, EMAIL, PHONE]

DATA PROCESSOR ("Processor"):
- Legal Name: [PROCESSOR LEGAL NAME]
- Address: [FULL ADDRESS]
- Contact: [NAME, EMAIL, PHONE]
- Data Protection Contact: [DPO NAME, EMAIL]

RECITALS

WHEREAS, Controller and Processor have entered into an agreement for AI-related services ("Principal Agreement");

WHEREAS, Processor will process Personal Data on behalf of Controller using AI systems in connection with the Principal Agreement;

WHEREAS, the parties wish to ensure that the processing of Personal Data by AI systems complies with applicable data protection laws including GDPR, CCPA/CPRA, and other privacy regulations;

WHEREAS, AI systems present unique data processing considerations including training data usage, model inputs and outputs, and algorithmic decision-making;

NOW, THEREFORE, the parties agree as follows:

ARTICLE 1: DEFINITIONS

1.1 "AI System" means the artificial intelligence system(s) used by Processor to provide services under the Principal Agreement, as described in Schedule A.

1.2 "Applicable Data Protection Laws" means all laws and regulations relating to the processing of Personal Data, including GDPR, CCPA/CPRA, and other applicable privacy laws.

1.3 "Data Subject" means an identified or identifiable natural person whose Personal Data is processed.

1.4 "Input Data" means Personal Data provided to the AI System as inputs (prompts, queries, data for analysis).

1.5 "Model Training" means the process of using data to develop, train, fine-tune, or improve AI models.

1.6 "Output Data" means data generated by the AI System that may contain or be derived from Personal Data.

1.7 "Personal Data" means any information relating to an identified or identifiable natural person, as defined under Applicable Data Protection Laws.

1.8 "Processing" means any operation performed on Personal Data, including collection, use, storage, disclosure, and deletion.

1.9 "Security Incident" means any unauthorized access, acquisition, use, or disclosure of Personal Data.

1.10 "Special Category Data" means sensitive personal data as defined under GDPR Article 9, including data revealing racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, and data concerning sex life or sexual orientation.

1.11 "Sub-processor" means any third party engaged by Processor to process Personal Data on behalf of Controller.

ARTICLE 2: SCOPE OF PROCESSING

2.1 Subject Matter and Duration

This DPA governs Personal Data processing in connection with:

• Subject Matter: [DESCRIBE AI SERVICES]
• Duration: Duration of the Principal Agreement
• Nature of Processing: [DESCRIBE PROCESSING ACTIVITIES]

2.2 Categories of Data Subjects

2.3 Categories of Personal Data

2.4 Special Category Data

☐ Special Category Data will NOT be processed
☐ Special Category Data will be processed as follows:

2.5 AI-Specific Processing

Input Data Processing:
☐ Personal Data provided as AI System inputs
☐ Inputs processed for: [PURPOSE]
☐ Input retention: [RETENTION PERIOD]

Output Data Processing:
☐ Outputs may contain/reflect Personal Data
☐ Outputs used for: [PURPOSE]
☐ Output retention: [RETENTION PERIOD]

Model Training:
☐ Personal Data will NOT be used for Model Training
☐ Personal Data MAY be used for Model Training only with explicit consent/legal basis
☐ Only anonymized/aggregated data used for Model Training

ARTICLE 3: CONTROLLER OBLIGATIONS

3.1 Lawful Processing

Controller warrants that:

☐ Processing has a lawful basis under Applicable Data Protection Laws
☐ Data Subjects have been provided required information/notices
☐ Necessary consents have been obtained (if consent is the legal basis)
☐ Controller has authority to provide Personal Data to Processor

3.2 Instructions

Controller shall provide documented instructions for Processing, including:

☐ Purposes of Processing
☐ Types of Personal Data to be processed
☐ Duration of Processing
☐ Special requirements or restrictions

3.3 Data Subject Rights

Controller is responsible for:

☐ Responding to Data Subject rights requests
☐ Notifying Processor of relevant requests
☐ Providing information to Data Subjects about AI processing

3.4 AI-Specific Notices

Controller shall ensure Data Subjects are informed about:

☐ Use of AI in processing their data
☐ Automated decision-making (per GDPR Article 22)
☐ Logic involved in AI processing
☐ Significance and consequences of AI processing

ARTICLE 4: PROCESSOR OBLIGATIONS

4.1 Processing Limitations

Processor shall:

☐ Process Personal Data only on documented instructions from Controller
☐ Not process Personal Data for own purposes
☐ Not use Personal Data for Model Training without explicit authorization
☐ Promptly inform Controller if instructions appear unlawful

4.2 Confidentiality

Processor shall:

☐ Ensure personnel are bound by confidentiality obligations
☐ Limit access to authorized personnel only
☐ Train personnel on data protection requirements

4.3 Security Measures

Processor shall implement appropriate technical and organizational measures including:

☐ Encryption of Personal Data at rest and in transit
☐ Access controls and authentication
☐ Regular security testing
☐ Incident detection and response capabilities
☐ Business continuity measures

AI-Specific Security:
☐ Protection against adversarial attacks
☐ Prevention of model inversion/extraction attacks
☐ Secure handling of AI inputs and outputs
☐ Logging of AI processing activities

4.4 Sub-processors

(a) Controller's authorization for Sub-processors:
☐ General authorization with notification of changes
☐ Specific authorization required for each Sub-processor

(b) Current Sub-processors listed in Schedule B

(c) Processor shall:
- Impose data protection obligations on Sub-processors
- Remain liable for Sub-processor actions
- Notify Controller of Sub-processor changes with [DAYS] notice

4.5 International Transfers

Personal Data shall be transferred outside [EEA/JURISDICTION] only:

☐ To countries with adequacy decisions
☐ Subject to Standard Contractual Clauses (attached as Schedule C)
☐ Under other approved transfer mechanisms: [SPECIFY]

4.6 Data Subject Rights Assistance

Processor shall assist Controller with:

☐ Responding to Data Subject access requests
☐ Data portability requests
☐ Deletion/erasure requests
☐ Objections to automated decision-making
☐ Requests for human review of automated decisions

4.7 Security Incident Response

(a) Processor shall notify Controller of Security Incidents within [24/48/72] hours

(b) Notification shall include:
- Description of incident
- Categories and approximate number of Data Subjects affected
- Likely consequences
- Measures taken or proposed

(c) Processor shall cooperate with Controller's incident response

4.8 Data Protection Impact Assessment

Processor shall assist Controller with DPIAs by providing:

☐ Information about AI System processing
☐ Security measures implemented
☐ Risk assessment information
☐ Bias and fairness testing results

4.9 Compliance Demonstration

Processor shall:

☐ Make available information necessary for compliance demonstration
☐ Allow and contribute to audits and inspections
☐ Maintain records of processing activities

ARTICLE 5: AI-SPECIFIC PROVISIONS

5.1 AI Transparency

Processor shall provide Controller with:

☐ Description of AI System capabilities and limitations
☐ Information about AI model(s) used
☐ Explanation of how Personal Data is processed by AI
☐ Information needed for Data Subject transparency

5.2 Model Training Restrictions

Unless explicitly authorized in writing:

☐ Processor shall NOT use Controller's Personal Data for Model Training
☐ Processor shall NOT use Input Data for Model Training
☐ Processor shall NOT use Output Data for Model Training
☐ Processor shall NOT share Personal Data with third parties for training

If Model Training is authorized:

☐ Training limited to: [SPECIFY SCOPE]
☐ Anonymization/aggregation required: ☐ Yes ☐ No
☐ Opt-out mechanism available: ☐ Yes ☐ No
☐ Training data retention: [PERIOD]

5.3 Automated Decision-Making

If AI System makes automated decisions about Data Subjects:

☐ Processor provides meaningful information about logic involved
☐ Human review mechanism available
☐ Controller can request human intervention for specific decisions
☐ Processor supports Controller's GDPR Article 22 compliance

5.4 Input/Output Data Handling

Input Data:
☐ Input Data retained only as long as necessary for processing
☐ Input Data deleted: [TIMEFRAME]
☐ Input Data not logged/stored beyond immediate processing need
☐ Other: [SPECIFY]

Output Data:
☐ Output Data may contain Personal Data derivatives
☐ Output Data retention: [PERIOD]
☐ Controller responsible for Output Data once delivered

5.5 AI Bias and Fairness

Processor represents:

☐ AI System has been tested for bias
☐ Bias mitigation measures implemented
☐ Will notify Controller of discovered bias affecting Personal Data processing
☐ Will cooperate with Controller's fairness assessments

5.6 AI System Changes

Processor shall notify Controller before:

☐ Material changes to AI System processing Personal Data
☐ Changes affecting data protection measures
☐ Changes to AI model versions
☐ Changes to Sub-processors providing AI services

ARTICLE 6: DATA RETENTION AND DELETION

6.1 Retention Periods

6.2 Deletion and Return

Upon termination or Controller request:

☐ Processor shall delete Personal Data within [DAYS]
☐ OR return Personal Data to Controller
☐ Certify deletion in writing
☐ Delete from AI training data (if applicable and technically feasible)

Exceptions: Processor may retain data required by law for [PERIOD].

6.3 Deletion from AI Systems

☐ Processor will delete Personal Data from AI System databases
☐ Personal Data in trained models: [HANDLING - e.g., not feasible to remove / will retrain without data]
☐ Logs containing Personal Data deleted per retention schedule

ARTICLE 7: AUDITS AND COMPLIANCE

7.1 Audit Rights

Controller may:

☐ Conduct audits of Processor's compliance
☐ Engage third-party auditors (subject to confidentiality)
☐ Review Processor's certifications and audit reports
☐ Request specific compliance information

7.2 Audit Procedures

☐ [DAYS] advance notice required
☐ Audits during normal business hours
☐ Scope limited to AI processing and data protection
☐ Controller bears audit costs (unless audit reveals material breach)

7.3 Certifications

Processor maintains:

ARTICLE 8: LIABILITY AND INDEMNIFICATION

8.1 Liability Allocation

Each party is liable for damages caused by processing in violation of:
- This DPA
- Applicable Data Protection Laws
- Controller's lawful instructions

8.2 Indemnification

Processor shall indemnify Controller for:
- Processor's breach of this DPA
- Processor's breach of Applicable Data Protection Laws
- Sub-processor violations

Controller shall indemnify Processor for:
- Controller's breach of this DPA
- Unlawful instructions
- Controller's breach of Applicable Data Protection Laws

8.3 Limitation

Liability limitations in the Principal Agreement apply to this DPA, except:
☐ No limitation for willful or grossly negligent violations
☐ Regulatory fines not subject to limitation

ARTICLE 9: TERM AND TERMINATION

9.1 Term

This DPA commences on the Effective Date and continues for the duration of the Principal Agreement.

9.2 Survival

Confidentiality, data deletion, and indemnification provisions survive termination.

ARTICLE 10: GENERAL PROVISIONS

10.1 Governing Law

This DPA is governed by [JURISDICTION] law.

For EU data: GDPR provisions govern regardless of choice of law.

10.2 Conflict

In case of conflict between this DPA and the Principal Agreement regarding data protection, this DPA prevails.

10.3 Amendments

Amendments must be in writing signed by both parties.

10.4 Entire Agreement

This DPA and its Schedules constitute the entire data processing agreement.

SIGNATURES

CONTROLLER:

Signature: _________________________________

Name: [NAME]

Title: [TITLE]

Date: _________________________________

PROCESSOR:

Signature: _________________________________

Name: [NAME]

Title: [TITLE]

Date: _________________________________

SCHEDULE A: AI SYSTEM AND PROCESSING DESCRIPTION

A.1 AI System Description

A.2 Processing Activities

A.3 Technical Measures

[DESCRIBE TECHNICAL SECURITY MEASURES]

A.4 Organizational Measures

[DESCRIBE ORGANIZATIONAL SECURITY MEASURES]

SCHEDULE B: SUB-PROCESSORS

SCHEDULE C: STANDARD CONTRACTUAL CLAUSES

[ATTACH APPLICABLE SCCs FOR INTERNATIONAL TRANSFERS]

SCHEDULE D: TECHNICAL AND ORGANIZATIONAL MEASURES

D.1 Encryption

• At rest: [STANDARD]
• In transit: [STANDARD]

D.2 Access Control

• Authentication: [METHOD]
• Authorization: [METHOD]
• Logging: [SCOPE]

D.3 AI-Specific Security

• Model protection: [MEASURES]
• Input/output security: [MEASURES]
• Adversarial defense: [MEASURES]

This AI Data Processing Agreement template is provided for informational purposes. Legal counsel review is strongly recommended.