Does your AI supplier's data processing agreement cover GDPR Article 28? A clause check sheet for small businesses using AI tools
What you get: a finished Article 28 clause check sheet: one row per AI tool or supplier, one column per Article 28(3)(a) to (h) point plus the sub-processor terms in Article 28(2) and 28(4), a result formula that counts missing clauses, three made-up example rows, and a short what to do if a clause is missing list. Open each supplier's data processing agreement (DPA), mark Y, Partial or N per column, and the sheet tells you where the gaps are.
Short answer: when an AI tool processes personal data on your behalf (client emails, call recordings, customer chats, CVs), the supplier is your processor and Article 28 requires a written contract that covers specific points. Many suppliers publish a DPA; your job is to check that it covers every point and to keep the version you accepted.
Step 1: is the supplier your processor?
- Does the tool handle personal data that you put in or collect (names, emails, voices, chat logs, CVs)? If no personal data goes in, this sheet is not needed for that tool; note why.
- Does the supplier process it on your behalf, for your purpose? Then it is your processor and the row goes on the sheet.
- Do the terms let the supplier use the data for its own purposes? Article 28(10) says a processor that determines purposes and means is considered a controller for that processing. Flag it in column C and decide whether to switch that use off.
- Choose only processors with sufficient guarantees (Article 28(1)); an approved code of conduct or certification can be one element of that (Article 28(5)).
Step 2: the check sheet (one row per AI tool or supplier)
| Column | What to write | Source |
|---|---|---|
| A. AI tool / supplier and what it does with personal data | [tool, supplier] · [e.g. transcribes client calls] · DPA name, version and date, where it is (link, annex, signed PDF) | Your AI register entry |
| B. Processing details | Y / Partial / N: the DPA states subject-matter, duration, nature and purpose, type of personal data and categories of people, and your rights and obligations. The EDPB says "personal data pursuant to Article 4(1)" alone is not adequate. | Art. 28(3) first sentence; EDPB 07/2020 para 114 |
| C. (a) Documented instructions | Y / Partial / N: processes only on your documented instructions, including on transfers outside the EU; tells you first if a law requires otherwise. Note any clause letting the supplier use your data for its own purposes (for example improving its models). | Art. 28(3)(a); Art. 29; EDPB paras 116 to 121 |
| D. (b) Confidentiality | Y / Partial / N: people authorised to process the data are committed to confidentiality or under a statutory duty | Art. 28(3)(b); EDPB paras 122 to 124 |
| E. (c) Security (Art. 32) | Y / Partial / N: the DPA includes or references the actual security measures, needs your approval for changes and has them reviewed regularly, not just "appropriate measures" | Art. 28(3)(c); Art. 32; EDPB paras 125 to 127 |
| F. (d) + 28(2)/28(4) Sub-processors | Y / Partial / N: specific or general written authorisation; under general authorisation the supplier actively tells you of each intended addition or replacement and you can object (time frame stated); same data protection obligations flow down to each sub-processor; supplier stays fully liable for them | Art. 28(2), 28(3)(d), 28(4); EDPB paras 152 to 160 and footnote 54 |
| G. (e) Help with data subject requests | Y / Partial / N: assists you with access, erasure, objection and other Chapter III requests, so far as possible | Art. 28(3)(e) |
| H. (f) Help with Arts 32 to 36 | Y / Partial / N: assists with security, breach notification (ideally with a time frame and contact point), DPIAs and prior consultation, with details of how, not a restatement | Art. 28(3)(f); EDPB paras 133 to 137 |
| I. (g) Delete or return at the end | Y / Partial / N: at your choice deletes or returns all personal data after the service ends and deletes copies unless EU or Member State law requires storage; confirms deletion | Art. 28(3)(g); EDPB paras 139 to 142 |
| J. (h) Information and audits | Y / Partial / N: makes available all information needed to show compliance and allows for and contributes to audits and inspections by you or an auditor you mandate; no clearly disproportionate audit fees | Art. 28(3)(h); EDPB paras 143 to 145 |
| K. Unlawful instruction warning | Y / Partial / N: supplier must immediately tell you if, in its opinion, an instruction infringes data protection law | Art. 28(3) second subparagraph |
| L. In writing | Y / N: the DPA is in writing (electronic is fine) and you can show which version you accepted | Art. 28(9) |
| M. Result | =IF(COUNTIF(B2:L2,"N")>0,"Gap: "&COUNTIF(B2:L2,"N")&" clause(s) missing",IF(COUNTIF(B2:L2,"Partial")>0,"Check wording","All Art 28 points found")) | Art. 28(3) |
| N. Action, owner, date | [ask for DPA / ask for addendum / switch off personal data / replace tool / accepted with reason] · [role] · [dd/mm/yyyy] | Art. 5(2) accountability; Art. 28(1) |
Put Y, Partial or N in columns B to L. Use N when the point is not in the DPA at all, and Partial when it is there but only restates the law: the EDPB says a processing agreement should not merely restate the GDPR but say how each requirement will be met.
Three example rows (made-up suppliers, for illustration only)
Example row 2, a five-person accounting office, "Example AI note-taker" for client calls: A. records and transcribes client calls, DPA v3 linked from terms · B. Y · C. Partial: terms allow use of recordings to improve the service · D. Y · E. Y, security annex · F. Partial: general authorisation, public sub-processor list, no notice of changes · G. Y · H. Partial: breach notice "without undue delay", no contact point · I. Y · J. Y · K. Y · L. Y · M. Check wording · N. switch off service-improvement use; ask for change notices by email; owner: office manager.
Example row 3, an online shop, "Example AI chat assistant" on the website: A. answers customer chats, no DPA found, only general terms · B. N · C. N · D. N · E. Partial · F. N · G. N · H. N · I. Partial · J. N · K. N · L. N · M. Gap: 9 clause(s) missing (the count of N in B to L) · N. ask the supplier for a DPA within two weeks; if none, replace the tool.
Example row 4, a recruitment agency, "Example AI CV screener": A. ranks CVs for client roles, signed DPA on Commission standard contractual clauses for Article 28 · B. to L. all Y · M. All Art 28 points found · N. keep the signed copy with your Article 30 records; review when the supplier announces new sub-processors.
What to do if a clause is missing
- Look again first: the DPA is often a separate page or annex incorporated by reference in the terms of service or order form. Save the exact version you accepted (Article 28(9): in writing, including electronic form).
- Ask for an addendum: write to the supplier naming the missing points, for example "Article 28(3)(g): please confirm deletion or return at our choice after the service ends". Article 28(6) to (8) allow the contract to be based on standard contractual clauses adopted by the Commission or a supervisory authority, and the EDPB says relying on them may help rebalance negotiating positions.
- Do not accept it just because you are small: the EDPB says the imbalance in contractual power between a small controller and a big provider does not justify accepting non-compliant terms; if you use the service, you have accepted responsibility.
- Sub-processors: ask to be actively told of each new or replaced sub-processor with time to object (Article 28(2)); a list on a website without notice is not enough, according to the EDPB. Check where they are with the international transfer check sheet.
- Audits: a clause that makes audits cost so much they would never happen is a Partial: the EDPB says clearly disproportionate or excessive cost clauses should not be inserted.
- If you cannot fix it: stop sending personal data to that tool, or replace it, and record the decision in column N. Under Article 82, a controller involved in processing is liable for damage caused by processing that infringes the GDPR, while a processor is liable only where it breached processor-specific obligations or acted outside your lawful instructions, so the written terms matter.
Do this week
- List every AI tool once in your register and add one row per supplier here
- Download or save each DPA and note its version and date in column A
- Fill columns B to L and sort by column M so the gaps come first
- Send one addendum request per Gap row and diary a follow-up date
- Check that each supplier's security annex matches your Article 32 access and security sheet
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 28, 29, 32 and 82, as published on gdpr-info.eu) and the EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version 2.1 (Part II, section 1, paragraphs 108 to 160). Example rows are made up for illustration and do not describe any real supplier. Checked on 24 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients who use AI note-takers, chat assistants or CV screeners often have never opened the supplier's DPA. Hand them this sheet with the client AI inventory and the AI supplier contract clauses guide so the check is written down. Stay inside your professional rules and refer legal questions on.
Keep the answer next to your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once and attach its DPA check row as an evidence record.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this sheet. Related: Article 30 records · international transfer check · AI supplier contract clauses · Article 32 access and security · 72-hour breach sheet
Sources
- Article 28 GDPR, Processor (with Article 29, Article 32 and Article 82); official text: Regulation (EU) 2016/679
- EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version 2.1, Part II section 1 (paragraphs 108 to 160)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.