Introduction
When using AI cloud services (e.g. OpenAI API, Google Vertex AI, AWS Bedrock), personal data is frequently transmitted to third-party providers. In these cases, Art. 28 GDPR applies -- the provisions on data processing.
What Is Data Processing?
Data processing occurs when a service provider processes personal data on behalf of the controller. The controller determines the purposes and means of the processing.
When Does Data Processing Apply?
The decisive factor is whether the AI provider processes the data only on instruction from the controller or pursues its own purposes:
- Data processing (Art. 28): AI API processes user data exclusively for the provision of the agreed service
- Joint controllership (Art. 26): AI provider also uses data for its own purposes (e.g. model training)
- Separate controllership: Entirely separate purposes
Obligations of the Controller
As a controller, you must:
- Conclude a Data Processing Agreement (DPA)
- Review technical and organisational measures
- Approve or reject sub-processors
- Safeguard third-country transfers (SCCs, adequacy decision)
- Conduct regular audits
DPA Checklist for AI Services
| Checkpoint | Status |
|---|---|
| Subject matter and duration of processing defined | ☐ |
| Nature and purpose of processing described | ☐ |
| Types of personal data listed | ☐ |
| Categories of data subjects named | ☐ |
| TOMs of the processor reviewed | ☐ |
| Sub-processor list obtained | ☐ |
| Deletion concept agreed | ☐ |
| Audit rights secured | ☐ |
Attention with US-Based Providers
For providers based in the US, you must check whether an adequacy decision (EU-US Data Privacy Framework) applies or Standard Contractual Clauses (SCCs) are required. Conduct a Transfer Impact Assessment where applicable.
Practical Tips
- Check the provider's opt-out options regarding model training
- Document your review of TOMs in a verifiable manner
- Use European data centres where possible
- Create a record of processing activities (Art. 30 GDPR)
Further Reading
- Data subject rights in AI deployment
- Data Protection Impact Assessment for AI systems
Legal Protection for AI Cloud Services?
For GDPR-compliant data processing agreements and third-country transfers with AI providers, specialised legal advice is available — independent and focused on AI regulation.
Independent legal advice. No automated legal information. The platform ai-playbook.eu does not provide legal advice.
Technical Implementation of Data Protection Requirements?
Creativate AI Studio supports you in selecting privacy-compliant AI architectures, implementing opt-out mechanisms and building secure data processing pipelines.