Data Processing Agreement with AI Processing Annex
DATA PROCESSING AGREEMENT
Agreement Effective Date: [__/__/____]
This Data Processing Agreement ("DPA") is entered into by and between:
Controller: [________________________________] ("Controller")
Address: [________________________________]
Contact: [________________________________]
Processor: [________________________________] ("Processor")
Address: [________________________________]
Contact: [________________________________]
This DPA supplements the [________________________________] (the "Master Agreement") dated [__/__/____].
TABLE OF CONTENTS
- Definitions
- Scope and Roles
- Processing Instructions
- Compliance Obligations
- Confidentiality and Personnel
- Security Measures
- Subprocessors
- Data Subject / Consumer Rights Assistance
- Security Incidents
- Audit and Assessment Rights
- International Transfers
- Data Retention, Deletion, and Return
- Liability and Indemnification
- Term and Termination
- Miscellaneous
- Annex A — Data Inventory
- Annex B — Security Measures
- Annex C — Consumer Rights Support
- Annex D — International Transfers
- Annex E — AI Processing Addendum
1. DEFINITIONS
| Term | Definition |
|---|---|
| Personal Data | Information that identifies, relates to, describes, or is reasonably linkable to an identified or identifiable individual, as defined under applicable Privacy Laws |
| Processing | Any operation performed on Personal Data, including collection, use, storage, disclosure, deletion, and AI model training or inference |
| Privacy Laws | All applicable data protection and privacy laws, including CCPA/CPRA (Cal. Civ. Code § 1798.100 et seq.), CPA (C.R.S. § 6-1-1301), TDPSA (Tex. Bus. & Com. Code Ch. 541), CTDPA (Conn. Gen. Stat. § 42-515), GDPR (if applicable), and other state, federal, or international privacy laws |
| Security Incident | Any unauthorized access to, acquisition of, use of, or disclosure of Personal Data, or any breach of security leading to accidental or unlawful destruction, loss, or alteration of Personal Data |
| Subprocessor | Any third party engaged by Processor to process Personal Data on behalf of Controller |
| AI System | Any machine-based system that generates outputs (predictions, recommendations, decisions, content) that can influence decisions or environments, as referenced in NIST AI RMF and the EU AI Act |
| AI Output | Content, predictions, recommendations, decisions, or other outputs generated by an AI System |
| Training Data | Data used to train, fine-tune, or validate AI models, including any Personal Data contained therein |
| Automated Decision-Making Technology (ADMT) | Technology that processes Personal Data to make decisions that produce legal or similarly significant effects on consumers |
| Sensitive Personal Data | Personal data defined as "sensitive" under applicable Privacy Laws (e.g., CCPA/CPRA § 1798.140(ae), TDPSA § 541.001(29)) |
2. SCOPE AND ROLES
2.1 Roles
Controller determines the purposes and means of Processing. Processor Processes Personal Data solely on behalf of and at the documented direction of Controller. If Processor determines purposes and means of any Processing independently, Processor shall be treated as a Controller with respect to that Processing.
2.2 Processing Description
The nature and purpose of Processing, categories of Personal Data, categories of data subjects, and duration are described in Annex A.
3. PROCESSING INSTRUCTIONS
3.1 Processor shall Process Personal Data only on documented instructions from Controller, unless required to Process by applicable law. If required by law to Process in a manner not instructed by Controller, Processor shall notify Controller before Processing unless prohibited by law.
3.2 Processor shall promptly notify Controller if, in Processor's opinion, an instruction from Controller violates applicable Privacy Laws.
3.3 Controller warrants that its instructions comply with applicable law and that it has provided all required notices and obtained all required consents for Processing.
4. COMPLIANCE OBLIGATIONS
4.1 Applicable Law Compliance
Processor shall comply with all applicable Privacy Laws in performing the Processing, including:
☐ CCPA/CPRA: Processor acting as a "service provider" or "contractor" shall not retain, use, or disclose Personal Data for purposes other than performing the contracted services (§ 1798.100(d)); shall not sell or share Personal Data; shall not combine Personal Data from multiple businesses except as permitted
☐ CPA: Processor shall process only pursuant to a binding contract specifying purpose, duration, nature, and type of Personal Data (C.R.S. § 6-1-1305(4))
☐ TDPSA: Processor shall comply with § 541.105 processor obligations
☐ CTDPA: Processor shall comply with § 42-520 processor obligations
☐ GDPR: If applicable, Processor shall comply with Article 28 processor obligations
4.2 Processor Representations
Processor certifies and represents that it:
☐ Understands and will comply with the restrictions in this DPA and applicable Privacy Laws
☐ Will notify Controller if it determines it can no longer meet its obligations under this DPA or applicable Privacy Laws
☐ Will cooperate with Controller's obligations relating to ADMT transparency, opt-outs, and risk assessments under the CPPA's ADMT regulations and similar state laws
5. CONFIDENTIALITY AND PERSONNEL
5.1 Processor shall ensure that all persons authorized to Process Personal Data are subject to written confidentiality obligations (whether contractual or statutory).
5.2 Processor shall provide regular training to personnel regarding privacy, data security, and AI usage limitations.
5.3 Processor shall limit access to Personal Data to personnel who require access to perform contracted services.
6. SECURITY MEASURES
6.1 Processor shall implement and maintain appropriate technical and organizational measures to protect Personal Data, as described in Annex B. These measures shall be no less protective than industry standards aligned with NIST Cybersecurity Framework 2.0 and ISO/IEC 27001:2022.
6.2 Processor shall maintain a documented incident response plan and business continuity plan.
6.3 Controller has the right to review security measures annually or upon reasonable request following a Security Incident.
6.4 Processor shall promptly address any identified security deficiencies and report remediation status to Controller.
7. SUBPROCESSORS
7.1 Processor shall not engage any Subprocessor without Controller's prior written authorization.
☐ General Authorization: Controller provides general authorization; Processor must notify Controller at least [____] days before adding or replacing a Subprocessor.
☐ Specific Authorization: Processor must obtain specific written approval for each Subprocessor.
7.2 Processor shall enter into written agreements with each Subprocessor imposing data protection obligations no less protective than those in this DPA.
7.3 Processor remains fully liable for the acts and omissions of its Subprocessors.
7.4 Controller has the right to object to a proposed Subprocessor within [____] days of notification. If Controller objects, the parties shall negotiate in good faith; if no resolution is reached within [____] days, Controller may terminate the affected Processing.
7.5 Current list of approved Subprocessors is maintained in Annex B or at: [________________________________]
8. DATA SUBJECT / CONSUMER RIGHTS ASSISTANCE
8.1 Processor shall assist Controller in responding to consumer/data subject rights requests, including:
| Right | Applicable Laws | Response Timeline |
|---|---|---|
| Right to Know / Access | CCPA/CPRA § 1798.100; CPA; TDPSA; GDPR Art. 15 | [____] days |
| Right to Delete | CCPA/CPRA § 1798.105; CPA; TDPSA; GDPR Art. 17 | [____] days |
| Right to Correct | CCPA/CPRA § 1798.106; CPA; TDPSA; GDPR Art. 16 | [____] days |
| Right to Portability | CCPA/CPRA; CPA; GDPR Art. 20 | [____] days |
| Opt-Out of Sale/Sharing | CCPA/CPRA § 1798.120 | [____] days |
| Opt-Out of Targeted Advertising | CPA; TDPSA; CTDPA | [____] days |
| Opt-Out of Profiling | TDPSA; CTDPA; CPA | [____] days |
| Limit Use of Sensitive PI | CCPA/CPRA § 1798.121 | [____] days |
| Opt-Out of ADMT | CPPA ADMT regulations; CPA | [____] days |
8.2 Processor shall notify Controller within [____] business days of receiving a rights request directly from a consumer/data subject.
8.3 Detailed workflows are in Annex C.
9. SECURITY INCIDENTS
9.1 Processor shall notify Controller without undue delay, and in no event later than [____] hours, after becoming aware of a Security Incident involving Personal Data.
9.2 Notification shall include:
☐ Nature of the incident and categories of data affected
☐ Approximate number of data subjects affected
☐ Name and contact information of Processor's incident response lead
☐ Description of likely consequences
☐ Description of measures taken or proposed to address the incident
9.3 Processor shall cooperate with Controller's investigation and remediation efforts, including forensic analysis and regulatory notification support.
9.4 Processor shall not notify affected individuals or regulators on Controller's behalf without Controller's prior written authorization, unless required by applicable law.
10. AUDIT AND ASSESSMENT RIGHTS
10.1 Controller may conduct audits or inspections up to [____] time(s) per year with [____] days' written notice, or more frequently if a Security Incident or material non-compliance is identified.
10.2 Processor shall cooperate with regulatory investigations and provide upon request:
☐ SOC 2 Type II reports
☐ ISO 27001 certificates
☐ Penetration test summaries
☐ Other compliance certifications
10.3 Each party bears its own audit costs, unless the audit reveals material non-compliance, in which case Processor shall bear the reasonable costs.
10.4 Processor shall cooperate with data protection assessments, risk assessments, and cybersecurity audits required under applicable Privacy Laws (including CCPA/CPRA § 1798.185(a)(15) and CPPA cybersecurity audit regulations).
11. INTERNATIONAL TRANSFERS
11.1 If Personal Data is transferred outside the originating jurisdiction, the Parties shall execute the appropriate transfer mechanism:
☐ Standard Contractual Clauses (SCCs) — EU Commission
☐ UK International Data Transfer Agreement (IDTA) / UK Addendum
☐ Binding Corporate Rules (BCRs)
☐ Consent of data subject
☐ Other lawful mechanism: [________________________________]
11.2 Completed transfer instruments are attached as Annex D.
11.3 Processor shall not transfer Personal Data to any jurisdiction not approved by Controller.
12. DATA RETENTION, DELETION, AND RETURN
12.1 Upon termination or expiration of the Master Agreement, Processor shall, at Controller's election:
☐ Delete all Personal Data (and certify deletion in writing within [____] days); or
☐ Return all Personal Data in a structured, commonly used, machine-readable format within [____] days
12.2 Processor shall instruct all Subprocessors to delete or return Personal Data on the same timeline.
12.3 Processor may retain Personal Data only if required by applicable law, and shall notify Controller of such retention and its legal basis.
12.4 Retention during the term shall be limited to what is reasonably necessary for the disclosed purpose, consistent with CCPA/CPRA § 1798.100(a)(3).
13. LIABILITY AND INDEMNIFICATION
13.1 Each Party's aggregate liability under this DPA is capped at $[________________________________], excluding breaches of confidentiality obligations, Security Incidents, violation of applicable Privacy Laws, and AI-related claims under Annex E.
13.2 Processor shall indemnify Controller against third-party claims, fines, and penalties arising from Processor's violation of applicable Privacy Laws, this DPA, or Annex E.
13.3 Neither Party excludes liability for gross negligence, willful misconduct, or fraud.
14. TERM AND TERMINATION
14.1 This DPA remains in effect for the duration of the Master Agreement and any continued Processing thereafter.
14.2 Either Party may terminate for material breach if not cured within [____] days of written notice.
14.3 Processor's obligations under Sections 5, 6, 9, 10, and 12 survive termination.
15. MISCELLANEOUS
15.1 Governing Law: This DPA shall be governed by the laws of the State of [________________________________].
15.2 Order of Precedence: In the event of conflict, this DPA controls over the Master Agreement with respect to Personal Data Processing.
15.3 Amendments: This DPA may only be amended in writing signed by both Parties.
15.4 Notices: All notices under this DPA shall be sent to the contacts identified above.
ANNEX A — DATA INVENTORY
| Category | Details |
|---|---|
| Categories of Data Subjects | [________________________________] |
| Categories of Personal Data | [________________________________] |
| Sensitive Personal Data | ☐ Yes ☐ No — If yes: [________________________________] |
| Processing Purposes | [________________________________] |
| Duration of Processing | [________________________________] |
| Legal Basis | [________________________________] |
| AI-Related Processing | ☐ Yes ☐ No — If yes, see Annex E |
ANNEX B — SECURITY MEASURES
Processor shall implement and maintain the following measures (at minimum):
Administrative Safeguards
☐ Written information security program
☐ Designated CISO or security leader
☐ Security awareness training (annual)
☐ Background checks for personnel with data access
☐ Incident response plan and testing
☐ Vendor/subprocessor security assessments
Technical Safeguards
☐ Encryption at rest (AES-256 or equivalent)
☐ Encryption in transit (TLS 1.2+)
☐ Multi-factor authentication
☐ Role-based access control with least privilege
☐ Centralized logging and SIEM monitoring
☐ Intrusion detection/prevention
☐ Vulnerability scanning (frequency: [____])
☐ Penetration testing (frequency: [____])
☐ Patch management (SLA: [____])
☐ Data loss prevention controls
☐ Secure development lifecycle (SAST/DAST)
Physical Safeguards
☐ Physical access controls at data centers
☐ Environmental controls (fire, water, power)
☐ Secure media disposal
Approved Subprocessors:
| Subprocessor | Services | Location | Data Categories |
|---|---|---|---|
| [________________________________] | [________________] | [________________] | [________________] |
ANNEX C — CONSUMER RIGHTS SUPPORT
| Right | Processor Obligation | Workflow | SLA |
|---|---|---|---|
| Access/Know | Search and compile responsive data | Controller sends request → Processor responds | [____] business days |
| Delete | Delete from all systems, backups (within reasonable time), and Subprocessors | Controller sends request → Processor confirms | [____] business days |
| Correct | Update inaccurate data | Controller sends request → Processor confirms | [____] business days |
| Portability | Export in machine-readable format | Controller sends request → Processor delivers | [____] business days |
| Opt-Out (Sale/Sharing) | Cease sale/sharing activities | Immediate upon instruction | [____] business days |
| Limit Sensitive PI | Restrict processing to permitted purposes | Upon instruction | [____] business days |
ANNEX D — INTERNATIONAL TRANSFERS
☐ Not applicable (all Processing within US)
☐ SCCs executed (Module [____]) — Attached
☐ UK IDTA / Addendum — Attached
☐ Other mechanism: [________________________________]
ANNEX E — AI PROCESSING ADDENDUM
E.1 Scope
This Annex applies when Processor uses AI Systems to Process Personal Data under the Master Agreement. It addresses AI-specific risks, transparency obligations, and regulatory requirements.
E.2 AI Model Inventory
| Model Name/ID | Version | Purpose | Risk Tier | Personal Data Used | Deployment Status |
|---|---|---|---|---|---|
| [________________________________] | [____] | [________________] | ☐ High ☐ Medium ☐ Low | ☐ Yes ☐ No | ☐ Production ☐ Development ☐ Testing |
| [________________________________] | [____] | [________________] | ☐ High ☐ Medium ☐ Low | ☐ Yes ☐ No | ☐ Production ☐ Development ☐ Testing |
E.3 Training and Fine-Tuning Restrictions
| # | Requirement | Response |
|---|---|---|
| E.3.1 | Processor shall not use Controller's Personal Data to train, fine-tune, or improve AI models without Controller's prior written consent | ☐ Acknowledged |
| E.3.2 | If training is authorized: identify specific datasets, document lawful basis, implement data minimization | ☐ Documented |
| E.3.3 | De-identification or aggregation shall be applied before using data for model improvement where feasible | ☐ Implemented |
| E.3.4 | Processor shall maintain records of all training datasets containing Personal Data | ☐ Maintained |
E.4 AI Output Controls
| # | Requirement | Response |
|---|---|---|
| E.4.1 | Implement technical measures to prevent unauthorized disclosure of Personal Data in AI Outputs (filters, guardrails, output sanitization) | ☐ Implemented |
| E.4.2 | AI Outputs containing Personal Data shall be subject to the same restrictions as the underlying Personal Data | ☐ Acknowledged |
| E.4.3 | Human review required before AI Outputs are used for decisions with legal or similarly significant effects on consumers | ☐ Implemented |
E.5 Risk Assessments and Bias Testing
| # | Requirement | Frequency |
|---|---|---|
| E.5.1 | Conduct AI impact assessments for high-risk AI Systems, aligned with NIST AI RMF | Before deployment; annually thereafter |
| E.5.2 | Perform bias and fairness testing across protected categories | Before deployment; annually |
| E.5.3 | Validate AI model accuracy and performance metrics | Quarterly |
| E.5.4 | Document assessment results and make available to Controller upon request | Ongoing |
| E.5.5 | Support Controller's data protection assessments involving AI Processing (CCPA/CPRA § 1798.185(a)(15); CPA; TDPSA) | As requested |
E.6 Human Oversight
| # | Requirement | Response |
|---|---|---|
| E.6.1 | Designate responsible individual(s) for AI deployment oversight | Name: [________________________________] |
| E.6.2 | Maintain escalation procedures for AI-related incidents (hallucinations, bias findings, data leakage) | ☐ Documented |
| E.6.3 | Ensure human review capability for ADMT decisions per CPPA ADMT regulations | ☐ Available |
E.7 Automated Decision-Making Compliance
| # | Requirement | Applicable Law |
|---|---|---|
| E.7.1 | Provide transparency regarding ADMT logic, input data, and output significance | CPPA ADMT regs (11 CCR § 7030); CPA |
| E.7.2 | Support consumer opt-out of ADMT for decisions with legal/significant effects | CPPA ADMT regs; CPA; TDPSA |
| E.7.3 | Support right to access ADMT results and logic explanation | CPPA ADMT regs |
| E.7.4 | Do not use Personal Data for ADMT producing legal/significant effects without documented DPIAs and opt-out capabilities | All applicable Privacy Laws |
E.8 AI Incident Response
In addition to Section 9, the following AI-specific incidents require notification:
☐ AI model producing systematically biased outputs affecting consumer classes
☐ Personal Data leakage through AI Outputs (memorization, extraction)
☐ Unauthorized use of Personal Data for model training
☐ AI system security compromise (model poisoning, adversarial attack)
☐ Material AI accuracy degradation affecting consumer decisions
Notification SLA for AI incidents: [____] hours.
E.9 Regulatory Alignment
| Regulation | Processor Obligations |
|---|---|
| NIST AI RMF 1.0 | Map, Measure, and Manage AI risks; document governance, impact assessment, and performance metrics |
| Colorado AI Act (SB 24-205) | If deploying high-risk AI systems: risk assessments, transparency, bias testing (eff. Feb. 1, 2026) |
| Illinois BIPA (740 ILCS 14) | If AI uses biometric data: obtain informed consent, provide retention/destruction schedule, do not sell |
| EU AI Act (Reg. 2024/1689) | If applicable: classify AI systems by risk; comply with high-risk requirements; transparency for general-purpose AI; document technical specifications |
E.10 Restrictions
Processor shall not:
☐ Use Personal Data to develop, train, or improve AI models for third parties
☐ Use AI-generated inferences about consumers to discriminate on the basis of protected characteristics
☐ Deploy AI Systems that make fully automated decisions with legal/significant effects without human oversight
☐ Retain AI-derived Personal Data longer than the retention period for the underlying Personal Data
SIGNATURES
CONTROLLER:
Name: [________________________________]
Title: [________________________________]
Signature: [________________________________]
Date: [__/__/____]
PROCESSOR:
Name: [________________________________]
Title: [________________________________]
Signature: [________________________________]
Date: [__/__/____]
SOURCES AND REFERENCES
- CCPA/CPRA, Cal. Civ. Code § 1798.100 et seq.
- CPPA ADMT Regulations, 11 CCR § 7030 et seq.
- Colorado Privacy Act, C.R.S. § 6-1-1301 et seq.
- Colorado AI Act, SB 24-205 (eff. Feb. 1, 2026)
- TDPSA, Tex. Bus. & Com. Code Ch. 541
- CTDPA, Conn. Gen. Stat. § 42-515 et seq.
- Illinois BIPA, 740 ILCS 14
- NIST AI Risk Management Framework 1.0 (Jan. 2023)
- EU AI Act, Regulation (EU) 2024/1689
- GDPR, Regulation (EU) 2016/679
This template is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel before use.
About This Template
Compliance documents are what regulated businesses use to prove they follow the rules that apply to their industry, whether that is privacy, anti-money-laundering, consumer protection, or sector-specific requirements. Regulators look for consistent policies, up-to-date records, and clear evidence of employee training. The cost of getting compliance paperwork right is almost always smaller than the cost of an enforcement action, fine, or public disclosure.
Important Notice
This template is provided for informational purposes. It is not legal advice. We recommend having an attorney review any legal document before signing, especially for high-value or complex matters.
Last updated: April 2026