Overview

When using external AI cloud services (e.g. LLM APIs, ML platforms, hosting services), data processing within the meaning of Art. 28 GDPR regularly applies.

In this case, a Data Processing Agreement (DPA) is required, which must contain certain minimum content. With AI services, additional specifics arise -- particularly regarding training data usage, model improvement and sub-processor chains.

This checklist serves as a structured review aid for organisations.

DPA Checklist (Art. 28 GDPR)

1. Basic Contract Structure

A) Subject Matter and Duration

• Is the subject of processing clearly described?
• Is the duration defined?
• Is the purpose precisely stated (e.g. "hosting an AI chatbot")?

B) Nature and Purpose of Processing

• Which processing steps are carried out (storage, training, inference)?
• Does model improvement take place?
• Does logging or analysis of prompts occur?

C) Categories of Personal Data

• Customer data
• Application/recruitment data
• Health data
• Usage data
• Sensitive categories (Art. 9 GDPR)?

D) Categories of Data Subjects

• Customers
• Employees
• Applicants
• Patients
• Others

2. Instruction Binding

• Is the instruction binding clearly regulated?
• Can instructions be documented?
• Is there a procedure for changing instructions?

3. Confidentiality

• Obligation of confidentiality for employees?
• Access restrictions defined?
• Role concepts in place?

4. Technical and Organisational Measures (TOMs)

• Encryption (in transit / at rest)
• Access control
• Logging
• Incident response process
• Backup and recovery mechanisms
• Protection against model manipulation

Are the TOMs described concretely as an annex?

5. Sub-Processors

• Are sub-processors used?
• Does a complete list exist?
• Is there a right of objection to changes?
• Are sub-processors contractually bound to equivalent standards?

6. Third-Country Transfers

• Does processing take place outside the EU/EEA?
• Does a DPF certification exist?
• Have Standard Contractual Clauses (SCCs) been concluded?
• Has a Transfer Impact Assessment been carried out?

7. Support for Data Subject Rights

• Does the service provider support access requests?
• Are erasure mechanisms defined?
• Can data be removed from training datasets?
• Is there support for objection procedures?

8. Training Data Usage and Model Improvement (AI-Specific)

• Is customer data used for model training?
• Does usage occur only in anonymised/pseudonymised form?
• Can usage for training purposes be deactivated?
• Is the purpose transparently regulated?

9. API Logging and Data Storage

• Are prompts stored?
• Are outputs stored?
• How long is storage retained?
• Are retention periods defined?

10. Audit and Control Rights

• Does an audit right exist?
• Are certifications provided (e.g. ISO)?
• Is an audit process defined?

11. Data Deletion and Return

• Is data deleted or returned after contract termination?
• Is the deletion process documented?
• Is there evidence of deletion?

12. Incident Management

• Is a reporting obligation for data protection incidents regulated?
• Are deadlines defined?
• Are cooperation obligations agreed?

Compact Review Matrix

Typical Sources of Error

Practical Recommendation

Before deploying an AI cloud service, you should:

1. Carry out role clarification (controller vs. processor).
2. Review or renegotiate the DPA.
3. Analyse the sub-processor chain in full.
4. Document third-country transfers.
5. Contractually regulate training data usage clearly.

Next Steps

1. Review existing AI cloud contracts against this checklist.
2. Identify gaps in training data or sub-processor provisions.
3. Clarify third-country transfer mechanisms.
4. Update your documentation.
5. Have your DPA reviewed by qualified experts if necessary.