Explainer · reading a DPA
What is a data processing agreement (DPA)?
A data processing agreement (DPA) is the contract between your company and a vendor that handles personal data on your behalf.
It says what the vendor may do with the data, how it keeps it safe, and what happens when the vendor brings in another company to help.
The law is quoted from the official text. Every vendor clause is from an agreement we read on the date shown, with a fingerprint (SHA-256 hash) of the dated copy we kept.
Who is who
Who is the controller, and who is the processor?
The GDPR, the EU data protection law, names the two sides. Your company is usually the controller. The vendor is the processor.
You
The controller
GDPR Article 4(7)
‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data …
Your vendor
The processor
GDPR Article 4(8)
‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller
California uses different words for a similar role: a business, and its service provider. The service provider’s status depends on a written contract.
California Civil Code §1798.140(ag)(1)
“Service provider” means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumer’s personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from: (A) Selling or sharing the personal information. …
The requirement
The law requires the contract.
In the EU
GDPR Article 28(3)
Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.
In California
California Civil Code §1798.100(d)
A business that collects a consumer’s personal information and that sells that personal information to, or shares it with, a third party or that discloses it to a service provider or contractor for a business purpose shall enter into an agreement with the third party, service provider, or contractor, that: (1) Specifies that the personal information is sold or disclosed by the business only for limited and specified purposes. …
Contents
What must a DPA contain under the GDPR?
Article 28(3) goes on to list what the contract must stipulate. The processor:
- (a)processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject;
- (b)ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
- (c)takes all measures required pursuant to Article 32;
- (d)respects the conditions referred to in paragraphs 2 and 4 for engaging another processor;
- (e)taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III;
- (f)assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor;
- (g)at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;
- (h)makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.
GDPR Article 28(3)(a)–(h), quoted from the official text, read September 30, 2026. Point (a) is shortened at a semicolon; the full text continues with an exception for notifying the controller of a legal requirement.
Sub-processors
The sub-processor clause is the part that changes after you sign.
Point (d) refers back to paragraph 2, which governs the vendor bringing in a sub-processor: a company your vendor hands your data to. It is the part of a DPA that moves.
The vendor adds a name to a published list, and the clause decides what you can do about it.
GDPR Article 28(2)
The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.
Vendors write the notice period, the period to object, or both into their DPAs, and a few onto their sub-processor pages. Some also state what happens if you say nothing.
OpenAI
30days to object
Customer may object to the use of such additional Sub-processor within 30 days of receiving notice of the change by following the instructions set forth in the Sub-Processor List or by contacting [email address on the vendor's page].
read November 14, 2026 · fingerprint 140ecaafd530
Dataiku
30days to object
If Customer does not object within the said period of thirty (30) days, Customer is deemed to have accepted the new Subprocessor.
read October 15, 2026 · fingerprint e701bf9b988d
We quote the window from 81 AI vendors’ clauses:
- 55
- state a period to object
- 21
- state a notice period before the change
- 32
- state 30 days
Every window we hold is listed with its clause, and what a sub-processor is has its own page.
Where to find one
Where do AI vendors publish their DPAs?
We watch 1,164 pages from 186 AI vendors and can currently read 98 DPAs and 122 sub-processor lists. We keep a dated copy of each reading.
Where each vendor publishes lists the addresses, and says which pages we couldn’t read, and why.
Common questions.
- What is a DPA?
- A data processing agreement is the contract between a company that decides why and how personal data is processed (the controller, in GDPR terms) and a vendor that processes it on the company's behalf (the processor). GDPR Article 28(3) requires such a contract.
- Is a DPA required?
- GDPR Article 28(3) says processing by a processor "shall be governed by a contract or other legal act". Under California law, Civil Code §1798.100(d) requires a business that discloses personal information to a service provider or contractor to enter into an agreement with it.
- What must a DPA contain?
- GDPR Article 28(3) lists what the contract must set out and stipulate, including that the processor acts only on documented instructions, keeps the data confidential, respects the conditions for engaging another processor, and deletes or returns the data at the end of the service.
- What does a DPA say about sub-processors?
- Article 28(2) lets a processor engage another only with the controller's specific or general written authorization. If general, it must inform the controller of changes, so it can object. The vendor's DPA says how notice is given and how long you have to object.
- Can a vendor change its DPA?
- Vendors publish their DPAs and sub-processor lists as web pages and can edit them. For the AI vendors it watches, Xither keeps a dated copy of each reading of these pages, with a fingerprint (SHA-256 hash), and records when one changes.
Not legal advice.
This page quotes the law and published agreements on the dates shown. A negotiated contract may say something else, and it governs.
Xither Staff Writer · reviewed September 30, 2026. Vendor clauses and counts are generated from the record when the page is served.
Hear the morning we read a change to your vendor’s sub-processor list or DPA.
Name the AI vendors in your product. When a page you watch changes a fact, you get the lines that moved and the date any window runs out.
Try it free for 14 daysNo card. Nothing to cancel.