AI Data Processing Agreement (DPA)

AI DATA PROCESSING ADDENDUM

Effective Date: [__/__/____]

Principal Agreement: [TITLE / DATE / PARTIES]

1. PARTIES AND CONTRACT HIERARCHY

This Addendum governs only the processing and AI activities identified in the completed Schedules. If documents conflict, the following order applies only to the identified subject matter: [________________________________].

2. JURISDICTION, ROLE, AND OBLIGATIONS GATE

Complete separately for each processing activity. Do not assume that labels used by one law apply under another.

Counsel and review date: [________________________________]

3. DEFINITIONS

For this Addendum:

“AI System” means only the system, model, component, tool, or feature identified in Schedule 1.

“Covered Data” means the data identified in Schedule 2 and does not expand a statutory definition.

“Covered Processing” means the collection, use, access, generation, disclosure, storage, alteration, analysis, training, testing, retrieval, deletion, or other operation specifically identified in Schedule 2.

“Incident” means the event selected in Schedule 5 for contractual response and does not replace any governing statutory definition.

“Output” means content or data generated through a covered AI activity, subject to the completed provenance and rights analysis.

“Subcontractor” means a third party engaged for Covered Processing as identified under the selected applicable requirements and Schedule 4.

Other defined terms: [________________________________]

4. PROCESSING INSTRUCTIONS AND PURPOSES

Party B shall conduct Covered Processing only for the purposes, instructions, permissions, and independent-role activities stated in Schedule 2.

Instruction-change method: [________________________________]

Unlawful, conflicting, infeasible, or insecure instruction process: [________________________________]

Responsibility for obtaining data and authority: [________________________________]

Nothing in this Addendum authorizes a new purpose, disclosure, sale, sharing, profiling, training use, automated decision, or sensitive-data use not expressly completed in the Schedules.

5. AI TRAINING, IMPROVEMENT, AND EVALUATION

Select separately for prompts, uploads, outputs, feedback, telemetry, logs, embeddings, derived data, and other artifacts.

Authorized models, tenants, accounts, and environments: [________________________________]

Opt-in, opt-out, consent, notice, or other authority: [________________________________]

De-identification, anonymization, aggregation, pseudonymization, and reidentification controls: [________________________________]

Removal from datasets, indexes, caches, checkpoints, and trained models: [TECHNICAL METHOD / LIMIT / NOT PROMISED]

6. INPUTS, OUTPUTS, AND AUTOMATED DECISIONS

The parties do not assume that every AI output is personal data, anonymous data, accurate, explainable, noninfringing, or suitable for an intended decision. The completed activity analysis controls.

7. PERSON OR CONSUMER REQUESTS

Request-routing contact and secure method: [________________________________]

Search, access, correction, deletion, portability, opt-out, restriction, objection, appeal, or other technical capability: [________________________________]

Assistance is limited to requests and duties that apply to the covered activity and the party's actual role.

8. SECURITY AND CONFIDENTIALITY

Party B shall implement the technical and organizational measures selected in Schedule 3, taking account of the Covered Data, systems, threats, risk, role, contract, and applicable requirements.

Schedule 3 must address, as applicable:

☐ Identity, authentication, authorization, and privileged access

☐ Encryption and key management

☐ Tenant and environment isolation

☐ Logging, monitoring, detection, and response

☐ Secure development, testing, vulnerability, patch, and change management

☐ Backup, resilience, recovery, and deletion

☐ Personnel confidentiality and training

☐ Model, prompt, tool, agent, retrieval, plugin, and output security

☐ Adversarial inputs, extraction, inversion, poisoning, exfiltration, and misuse controls

☐ Physical, vendor, and supply-chain controls

Security exception and residual-risk approval: [________________________________]

9. INCIDENT RESPONSE

The contractual deadline does not replace a shorter legal or regulatory deadline. A party shall not make an external notification on another party's behalf without the authority stated here, except when independently required.

10. SUBCONTRACTORS AND ONWARD RECIPIENTS

Authorization method: [SPECIFIC / GENERAL WITH NOTICE / OTHER]

Objection, replacement, termination, and continuity process: [________________________________]

Required flow-down terms: [________________________________]

Party B's responsibility for subcontractor performance: [________________________________]

The current list, locations, services, data, transfer routes, and evidence appear in Schedule 4.

11. CROSS-BORDER AND REMOTE ACCESS

No transfer mechanism is incorporated merely by mentioning standard clauses. Attach the exact current instrument, module, parties, annexes, selections, signatures, and supplementary-measures analysis required for the route.

12. RETENTION, RETURN, AND DELETION

Termination instruction deadline: [________________________________]

Deletion certification scope and signer: [________________________________]

Retention required or independently permitted by law: [AUTHORITY / SEGREGATION / ACCESS / FINAL DELETION]

13. ASSESSMENTS, AUDITS, AND COMPLIANCE EVIDENCE

Remediation and verification process: [________________________________]

14. LIABILITY, INDEMNITY, AND REMEDIES

Complete after reviewing governing law, regulatory allocation, the Principal Agreement, insurance, data and AI risks, bargaining position, and third-party claims.

No liability category is automatically uncapped or indemnified by this universal form.

15. TERM, CHANGE, AND TERMINATION

Start and duration: [________________________________]

Surviving provisions and duration: [________________________________]

Change-in-law, role, system, model, purpose, subprocessors, locations, or risk process: [________________________________]

Termination rights and transition assistance: [________________________________]

16. SIGNATURES

SCHEDULE 1 — AI SYSTEMS AND SERVICES

SCHEDULE 2 — PROCESSING DETAILS

SCHEDULE 3 — SECURITY MEASURES

SCHEDULE 4 — SUBCONTRACTORS AND TRANSFERS

SCHEDULE 5 — INCIDENT AND CONTACT MATRIX

SCHEDULE 6 — MANDATORY JURISDICTION-SPECIFIC TERMS

Attach only the completed, current terms required for the selected roles and processing, including any exact international-transfer instrument.

[END OF DOCUMENT]