GDPR and DPA for AI: review the agreement and the data flow
When a processor agreement is needed, how OpenAI and Anthropic describe their terms, and what to prepare for legal review and technical implementation.
Syntalith
A data processing agreement, or DPA, governs the relationship with a provider acting as a processor. Article 28 GDPR requires appropriate processor terms when the provider processes personal data on your behalf. Not every recipient has that role. A DPA also does not establish that your company may submit any document to an AI service. Article 28 GDPR
Before deployment, connect the contractual terms to the actual workflow: inputs, connected systems, stored outputs and people with access. This guide helps prepare the technical and legal review. The client approves the specific processing arrangement with the appropriate specialist.
Establish which personal data the task needs
Information about a company is not always personal data. A named CRM contact, customer case or employee record may identify individuals. Confidentiality still matters when a document falls outside GDPR. European Commission explanation
Record the purpose and the minimum fields required. Establish the lawful basis, transparency obligations and retention period. Selecting a model or disabling training does not supply the company's lawful basis.
For example, drafting a complaint response may require a description of a defect and a policy extract. A complete CRM export contains much more information, and its necessity needs a separate justification. Preparing customer data for AI
A DPA does not always need a separately signed PDF
Article 28 allows written agreements in electronic form. Processor terms may be incorporated into accepted service terms. What matters is whether they apply to the purchased product, the correct organisation and the intended data scope.
OpenAI's DPA describes incorporation into its services agreement and its processor role for covered customer data. Anthropic explains that its DPA is automatically part of the Commercial Terms of Service. Purchasing through a reseller or another platform requires a review of the relevant contractual chain.
Do not assume every individual subscription has the same terms as a commercial service. Keep the applicable version and a record of who accepted it for the company.
Review both the contract and the product
| Area | Decision to make | Evidence for the workflow |
|---|---|---|
| Roles and instructions | Who acts as controller and processor? | Contract and processing description |
| Subprocessors | How are further processors authorised and changes communicated? | Applicable terms and provider list |
| Access | Who can retrieve files, outputs and connected-app data? | Configuration and a test-account check |
| Retention | What remains after a conversation or user is deleted? | Rules for files, history, logs and copies |
| Rights and incidents | How does the provider help with requests and breaches? | Procedure, contact route and responsible owner |
| Transfers | Does data move outside the EEA, and under which conditions? | Data-flow description and applicable transfer mechanism |
Article 28 covers matters including instructions, confidentiality, safeguards, assistance, return or deletion and information needed to demonstrate the processor's obligations. Article 32 safeguards are risk-based. An Article 35 impact assessment is required where processing is likely to result in high risk; using AI alone does not automatically trigger it. GDPR text
European hosting does not finish the assessment
Review access, subprocessors and connected services too. GDPR does not require every AI system to operate entirely on premises. Transfers outside the EEA must meet the relevant Chapter V conditions, for example through an adequacy decision or appropriate safeguards. A storage-region statement does not automatically describe every processing operation.
Likewise, no training does not mean zero retention. OpenAI and Anthropic describe business data protections and separate storage arrangements for products and features. OpenAI Enterprise Privacy, Anthropic retention
What Syntalith prepares and what it costs
An AI process audit starts at €600 net. The core deliverables are a process map, architecture, implementation plan and fixed build quote. For a task involving personal data, we can agree a scope covering data flows, access requirements and technical acceptance checks. This gives the person conducting the legal review a description of the actual proposed solution.
This is a technical and process engagement. Legal advice, approval of the lawful basis and any required impact assessment remain with the client's appropriate specialists. Configuration, integration development and software subscriptions need an agreed scope and budget.
Once the environment is approved, team training, from €600 net per day, helps employees practise data preparation and output review. Start with a free 30-minute scan: describe the workflow, users and types of information involved.
Related decisions
- Personal ChatGPT and Claude accounts at work
- Training opt-out and GDPR
- Auditing accounts and shadow AI
Sources and service prices checked on 30 September 2026. Confirm the terms covering the selected product and purchasing route before ordering.
Syntalith is an OpenAI Select Partner in the OpenAI Partner Network.
We help your team respond to customers faster and find information in company documents. We choose and set up the right AI tools, then teach your team how to use them.
How to introduce ChatGPT and OpenAI at workFree process scan
Start with a free process scan.
- A 30-minute call with the engineer who would lead the work.
- A review of the processes that cost you the most time and money.
- A written summary: a possible direction, missing information and the next step.
The scan chooses one process to assess, and within 2 business days you receive a recommendation, including when a simpler route is the better fit.
€0
30 minutes · written takeaway within 2 business days
Times are shown in your own time zone. We work with clients across time zones.
Describe the process in the form