Data Processing Addendum
Also written: DPA
A contract detailing how a service provider handles personal data for its customers.
A Data Processing Addendum, or DPA, is a contract between a company that uses a service and the company providing that service. It explains exactly how the service provider will handle any personal data they process on the customer's behalf.
For example, if a business uses an AI tool to analyze customer feedback, the DPA would outline how the AI company stores, uses, and protects that customer data. This is important for meeting privacy regulations like GDPR or CCPA.
A Data Processing Addendum (DPA) is a legally binding agreement that specifies the terms and conditions under which a data processor (the service provider) will process personal data on behalf of a data controller (the customer). It typically covers the scope, nature, purpose, and duration of the processing, as well as security measures, data subject rights, and breach notification procedures.
DPAs are crucial for compliance with data protection laws. They ensure that the data processor implements appropriate technical and organizational measures to protect personal data and assists the data controller in fulfilling its obligations.
Data Processing Addenda are appearing more frequently as AI companies offer tools that process user data. These agreements clarify how sensitive information is handled, especially for specialized services like advertising tools or general AI applications, ensuring compliance with privacy laws.
- Ad Tools data processing addendumOpenAI · OpenAI Policies ·
- Data Processing AddendumAnthropic · Legal and Policies ·
- Anthropic Claude
- Anthropic has a Data Processing Addendum that details the handling of customer data when using their AI services.
- OpenAI ChatGPT
- OpenAI provides a Data Processing Addendum that outlines how customer data is processed, particularly for specific tools like their Ad Tools.
- Terms of Service
- A broader agreement covering the use of a service, while a DPA
- Privacy Policy
- Explains how a company collects and uses personal data for its o
- Service Level Agreement
- Focuses on performance metrics and uptime, not the spec
The concept of data processing agreements stems from data protection regulations like the EU's General Data Protection Regulation (GDPR), which mandates specific contractual clauses between data controllers and processors. Source ↗
Review the Data Processing Addendum for an AI service you use. Look for sections detailing data security measures or how your data is used for model improvement. Compare it to the service's main Privacy Policy to see the differences in focus.
The Playbook: reusable how-tos, prompts, configs and tips pulled out of the news.
- PromptRole-play a student struggling with math for AI tutor simulationSimulate a student's math struggles and uncertainty for AI tutor evaluation. · 5 min
- TemplateReusable workflow templates for healthcare teamsTeams can create and share templates for common workflows like documentation or prior authorizations. · 15 min
- TemplateTemplate for building an AI tool tailored to your workA structured approach to defining and building a custom AI tool for specific business needs. · 15 min
- TemplateEvals CSV prompt list for agent skillsA CSV file template for listing prompts used in evaluating agent skills. · 20 min
- HeuristicDouble coding agent task completion with docs linksProviding coding agents with a documentation link significantly increases their task completion rate. · 2 min
Questions people ask
- What is the main purpose of a DPA?
- A DPA's main purpose is to ensure that personal data is processed securely and in compliance with privacy laws when one company handles data for another.
- Who needs a DPA?
- A DPA is needed when a service provider processes personal data on behalf of its customers, such as cloud services, AI platforms, or marketing tools.
First seen on Subvolts May 12, 2026. Updated Sep 15, 2026. Written by an AI model from the items above and reviewed against them weekly; report an error.