GDPR and generative AI: the questions to ask a vendor before you sign
An AI assistant that reads your company’s documents is a vendor processing personal data on your behalf. Before signing you need written answers on twelve points: role and contract, where the data goes, who else handles it, whether it trains models, how long it is kept, who sees what inside the tool, what is logged, the impact assessment, the AI Act, incidents and audits.
- 72 hours to notify the data protection authority of a breach, from when you become aware of it
- €5 million the Italian authority’s fine on the company behind Replika, a companion chatbot (2025)
- €158,000 the fine on Character.AI, partly for a late impact assessment (2026)
Key takeaways
- A generative AI vendor that handles your data on your behalf is a processor: you need a data processing agreement (DPA) with the content set out in article 28 of the GDPR, and the responsibility for choosing it well stays with you.
- Ask for the full list of sub-processors, where data is stored and processed, and on what basis it leaves the EU: according to the EDPB, the controller must have the identity of everyone in the chain available at all times.
- If the vendor uses your data to train its own models, it becomes a controller for that processing: rule it out in the contract, not just in the settings.
- Inside the tool, what matters is who sees what: an assistant connected to every document must not show an employee a colleague’s payslip. The GDPR requires data protection by design and by default (article 25).
- In Italy an impact assessment is required when processing with artificial intelligence systems also meets another European risk criterion (the Garante’s list, 2018), and the vendor must help you carry it out.
01 Why the questions come before the signature
A generative AI assistant that works on documents, email or customer conversations processes personal data on behalf of the company. In GDPR terms the company is the controller, because it decides why and how the data is processed, and the vendor is the processor, because it processes the data on the company’s behalf. A controller may only use processors that provide “sufficient guarantees” (article 28, paragraph 1): checking them beforehand is an obligation, not a courtesy.
And regulators are watching. In January 2025 the Italian data protection authority, the Garante, ordered DeepSeek to stop processing the data of people in Italy; it fined the company behind Replika, a companion chatbot, €5 million in 2025 (the decision is under appeal), and the company behind Character.AI €158,000 in July 2026, partly for an impact assessment carried out late. The €15 million fine on OpenAI from 2024, on the other hand, was annulled by the Court of Rome in March 2026 on a question of competence: once OpenAI had its establishment in Ireland, the decision belonged to the Irish authority, and the merits were never examined.
The lesson for a buyer is simple: ask before signing, in writing, and put the answers in the contract. There are twelve questions. Below you will find them in a table, then one by one, with why each matters and what a good answer sounds like.
02 The 12 questions in one table
| # | Question | Reference |
|---|---|---|
| 1 | Your role and the processing agreement | GDPR, art. 28 |
| 2 | Sub-processors and notice of changes | GDPR, art. 28(2); EDPB Opinion 22/2024 |
| 3 | Where data is stored and processed | GDPR, art. 28 and 32 |
| 4 | Transfers outside the EU | GDPR, chapter V; Data Privacy Framework |
| 5 | Training on your data | GDPR, art. 28(10); EDPB Guidelines 07/2020 |
| 6 | Retention and deletion | GDPR, art. 5(1)(e) and 28(3)(g) |
| 7 | Who sees what inside the tool | GDPR, art. 25 and 32 |
| 8 | Activity records | GDPR, art. 32; Workers’ Statute, art. 4 |
| 9 | Data protection impact assessment | GDPR, art. 35; Garante list (2018) |
| 10 | AI Act duties and where the model comes from | AI Act, art. 4, 26, 50; EDPB Opinion 28/2024 |
| 11 | Data breaches | GDPR, art. 33 |
| 12 | People’s rights and audits | GDPR, art. 28(3)(e) and (h) |
The Workers’ Statute is Italian Law 300/1970. Every reference is explained in the sections below.
03 Role, contract and the chain of vendors
1. What is your role in processing our data, and will you give us a data processing agreement (DPA)?
Why it matters. The contract with a processor has a minimum content set by article 28 of the GDPR: processing only on the controller’s documented instructions, confidentiality, security measures, rules on sub-processors, help with people’s rights and with the impact assessment, deletion or return of the data at the end of the service, audits and inspections. A personal account under consumer terms of use is not that kind of contract.
A good answer: “For the data you upload and for the conversations we are your processor. The DPA is attached to the contract, it can be signed, and it covers every point of article 28.”
2. Who are your sub-processors, and how will you tell us when they change?
Why it matters. A generative AI service is almost always a chain: the company selling you the application uses a model provider, a cloud provider, sometimes others. The GDPR requires your written authorization; if it is general, the vendor must inform you of changes and give you the chance to object (article 28, paragraph 2). According to the European Data Protection Board (EDPB), the controller must have the identity of everyone in the chain available at all times, whatever the risk, and the vendor should provide it on its own initiative and keep it up to date (Opinion 22/2024).
A good answer: a public list, or one attached to the DPA, with the name, location and role of each sub-processor, advance notice before any change, and a practical way to object.
04 Where the data goes: storage, processing, transfers
3. Where is the data stored, and where is it processed when the AI answers?
Why it matters. Storage and processing can sit in different places: the documents in a European data center, the request to the model in another country. Ask about both, for files, for conversations and for backups, and ask which company in the group provides the service: that is the one you will hold to the contract.
A good answer: the exact regions for storage, processing and backups, written into the contract, with a commitment not to change them without notice.
4. Does the data leave the European Union? On what basis?
Why it matters. A transfer outside the EU is lawful only with a basis in chapter V of the GDPR: an adequacy decision by the European Commission, or safeguards such as standard contractual clauses. For the United States the adequacy decision is the one on the Data Privacy Framework of 10 July 2023, which covers US companies certified under the program. As of 10 October 2026 it is in force: the EU General Court upheld it on 3 September 2025, and that judgment has been appealed to the Court of Justice. Its predecessor, the Privacy Shield, was struck down by the Court in 2020: it is worth asking what the fallback would be.
A good answer: “The data stays in the Union”, or the list of transfers with the basis for each (a certification you can check on the Data Privacy Framework list, standard contractual clauses) and what would happen if that basis fell away.
05 Training and retention: what happens to the data afterwards
5. Is our data used to train or improve your models, or your providers’ models?
Why it matters. A processor may use the data only on your behalf. If it uses it for its own purposes, such as training a model, it becomes a controller for that processing, with responsibilities of its own (article 28, paragraph 10; EDPB Guidelines 07/2020). This applies to questions, uploaded files, answers and ratings. A report prepared for the EDPB on large language models (April 2025, not an official position) applies the same logic to AI services: a provider that collects or keeps data for its own purposes becomes a controller of it.
A good answer: “Your content is not used to train models, neither ours nor our providers’, and it says so in the contract.” A switch in the settings, which someone could turn off, is not enough.
6. How long do you keep questions, files and answers, and how do you delete them?
Why it matters. Data should be kept for as long as necessary and no longer (article 5, paragraph 1, letter e) and, at the end of the service, deleted or returned at your choice, with every copy (article 28, paragraph 3, letter g). With AI there are more copies than usual: the conversation, the uploaded files, the search indexes (the representations of documents the system uses to find them again), the logs, the backups.
A good answer: a retention period for each type of data, deletion on request from the search indexes too, and written confirmation of deletion at the end of the contract, with the backup timelines.
06 Inside the tool: who sees what, and what is recorded
7. Who sees what inside the tool?
Why it matters. It is the question most often forgotten, and the most important one for tools that read company documents. An assistant connected to every folder can answer anyone with everything it finds: a customer’s contract, an employee’s appraisal, a colleague’s payslip. The GDPR requires that by default data is not made accessible to an indefinite number of people (article 25, paragraph 2), and security measures that ensure confidentiality (article 32).
A good answer: explicit permissions on documents, folders and assistants, checked on every question. And a way to test it: the same question, asked by two people with different permissions, must get two different answers.
8. What do you record of what happens in the tool, for how long, and who can see it?
Why it matters. Records are there for you: to understand who asked what, to reconstruct an incident, to answer an access request. But they are also employees’ personal data. In Italy the Workers’ Statute allows information collected through work tools to be used only if workers have been properly informed and privacy rules are respected (article 4). And the Garante pays close attention to data about employees’ activity: for email metadata it has indicated that retention should not exceed 21 days, barring documented needs (June 2024).
A good answer: activity records with retention periods you can set, access limited to those who need it, and the option to export them when you need to check something.
07 The impact assessment and the AI Act
9. Will you help us with the impact assessment?
Why it matters. A data protection impact assessment (DPIA) is the risk analysis the GDPR requires before processing that is likely to result in a high risk, particularly with new technologies (article 35). The Garante’s list of processing that requires one includes processing with innovative technologies, “artificial intelligence systems” among them, whenever at least one other European risk criterion also applies: for example evaluating people, at work too, systematic monitoring, sensitive data, large-scale processing, vulnerable people. For many business uses of AI a DPIA is therefore likely. You carry it out, but the vendor must assist you (article 28, paragraph 3, letter f). And doing it late is costly: it was one of the reasons for the fine on Character.AI.
A good answer: documentation ready on purposes, data flows, security measures and the model’s limits, and willingness to answer your data protection officer’s (DPO’s) questions.
10. What do we need from you for the AI Act, and what data was the model trained on?
Why it matters. A company that uses AI for work is a deployer under the AI Act: it must take measures to support its staff’s AI literacy (article 4) and, when it publishes deepfakes or generated text on matters of public interest, disclose it (article 50). If it uses high-risk systems, such as those that screen job applicants, from 2 December 2027 it will also have to keep their logs for at least six months and inform workers beforehand, among other duties (article 26). On the model itself, the EDPB writes that whoever deploys it should carry out an appropriate assessment to make sure it was not developed by processing personal data unlawfully, looking for example at where the data came from and at any infringement found by an authority or a court (Opinion 28/2024). A declaration of conformity under the AI Act, it adds, is not on its own a conclusive finding of GDPR compliance.
A good answer: clear instructions for use, material to train your staff, and information on the models used, their providers and where their training data came from.
08 When something goes wrong: incidents, requests, audits
11. How quickly will you tell us about a data breach, and with what information?
Why it matters. The GDPR requires the processor to inform the controller “without undue delay” (article 33, paragraph 2), and the controller to notify the authority within 72 hours of becoming aware of the breach (paragraph 1). A vague deadline leaves the timing of your response to the vendor: a number of hours in the contract is better.
A good answer: a deadline in hours written into the DPA, an incident contact who can always be reached, and the information you need to notify: what happened, which data, how many people, what has been done.
12. How will you help us with people’s requests, and how can we check what you do?
Why it matters. A customer or an employee can ask to access their data or have it deleted, even when it sits inside the tool’s conversations and documents: the vendor must assist you (article 28, paragraph 3, letter e). And you must be able to check that it does what it promises: the contract must allow audits and inspections (letter h). Security certifications help, but they do not replace the answers to the previous questions.
A good answer: tools to find, export and delete one person’s data, independent audit reports available on request, and a right to audit written into the contract.
09 Warning signs in the answers
Some answers already tell you enough:
- The DPA is “available on request”, but never arrives.
- The list of sub-processors is neither public nor attached to the contract.
- The exclusion from training is only a setting, not a written commitment.
- Nobody can say where the processing happens.
- The tool sees everything the administrator sees, for everyone.
- For incidents there is only a generic email address, with no deadline.
Our own answers to these questions are on our Security page: your data is stored in Europe, your content is not used to train the models (our contracts with the AI providers rule it out), permissions apply to every document, folder and Eko and are checked on every question, and the DPA with the list of providers is available. Prices are on the Pricing page.
10 Note on sources
This article is not legal advice. It is a list of questions and the reasoning behind each, based on the texts in force on 10 October 2026. For your own contract you need your DPO or a professional.
- Texts read at the source on 10 October 2026: the GDPR and the AI Act on EUR-Lex; EDPB Opinions 22/2024 and 28/2024, Guidelines 07/2020 and the report on large language models on the EDPB website; the Garante’s decisions and press releases; the Court of Rome’s judgment no. 4153/2026 and the Garante’s note referring to it; the Data Privacy Framework decision, judgment T-553/23 and appeal C-703/25 P on EUR-Lex.
- The good answers are examples written by us, not legal formulas.
- The appeal on the Data Privacy Framework appears to be pending: as of 10 October 2026 EUR-Lex shows no judgment.
- What could change. On 19 November 2025 the Commission proposed amendments to the GDPR (the Digital Omnibus), including an article on legitimate interest for developing and operating AI systems; as of 10 October 2026 the proposal is still before the European Parliament. The EDPB plans guidelines on how the AI Act and the GDPR fit together (work program 2026-2027).
Questions and answers
Is a generative AI vendor a data controller or a processor?
Usually a processor: it processes data on behalf of the client company, which remains the controller, and there must be a contract with the content of article 28 of the GDPR. It becomes a controller for any processing it carries out for its own purposes, for example if it uses customers’ data to train its own models.
Is a DPIA always required to use generative AI in a company?
Not always, but often. On the Italian Garante’s list, processing with artificial intelligence systems requires one when at least one other risk criterion also applies, such as evaluating people, systematic monitoring, sensitive data or large-scale processing. The vendor must help you carry it out.
Can we use an AI vendor based in the United States?
Yes, if the transfers have a basis in chapter V of the GDPR. For the United States there is the adequacy decision on the Data Privacy Framework (10 July 2023), valid for certified companies and in force on 10 October 2026; standard contractual clauses are the alternative. The judgment that upheld it is under appeal before the Court of Justice.
Can the vendor use our data to train its models?
If it does, for that processing it is no longer your processor but a controller in its own right, which needs its own legal basis and answers for it. For business use it is better to rule it out in the contract, for questions, files and answers, and for the model providers it relies on too.
What should a DPA with an AI vendor contain?
What article 28 of the GDPR requires (documented instructions, confidentiality, security, sub-processors, help with rights and the DPIA, deletion at the end of the service, audits) plus clauses specific to AI: no training on your data, retention periods for conversations and search indexes, processing locations, and deadlines in hours for incidents.
Does the AI Act change anything for companies that use ChatGPT or Copilot?
Yes. A company whose employees use AI for work is a deployer: it must take measures to support its staff’s AI literacy (article 4) and disclose deepfakes or generated text on matters of public interest when it publishes them (article 50). The European Commission uses exactly the example of employees writing advertising copy or translating with ChatGPT.
Sources
- Regulation (EU) 2016/679 (GDPR), articles 5, 25, 28, 32, 33 and 35, EUR-Lex.
- Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models, EDPB, 17 December 2024.
- Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s), EDPB, 7 October 2024.
- Guidelines 07/2020 on the concepts of controller and processor in the GDPR, EDPB.
- AI Privacy Risks & Mitigations: Large Language Models (LLMs), EDPB Support Pool of Experts, April 2025.
- List of processing operations subject to a DPIA, decision no. 467 of 11 October 2018, Garante per la protezione dei dati personali.
- Decision no. 33 of 30 January 2025 on DeepSeek, Garante per la protezione dei dati personali.
- Press release on the fine on Luka Inc. (Replika), Garante per la protezione dei dati personali, 19 May 2025.
- Press release on the fine on Character Technologies (Character.AI), Garante per la protezione dei dati personali, 9 July 2026.
- Decision no. 755 of 2 November 2024 on OpenAI, with the note on the Court of Rome judgment no. 4153/2026, Garante per la protezione dei dati personali.
- Decision no. 364 of 6 June 2024 on email metadata at work, Garante per la protezione dei dati personali.
- Commission Implementing Decision (EU) 2023/1795 on the EU-US Data Privacy Framework, EUR-Lex, 10 July 2023.
- Case C-703/25 P, Latombe v Commission, appeal of 31 October 2025, EUR-Lex.
- Regulation (EU) 2024/1689 (AI Act), consolidated text of 27 July 2026, EUR-Lex.
- Law no. 300 of 20 May 1970 (Workers’ Statute), article 4, Normattiva.
- Proposal COM(2025) 837 (Digital Omnibus), European Commission, 19 November 2025.