Do You Need a Data Processing Agreement for AI Tools? A Plain Answer for Small Business Owners

You need a data processing agreement for AI tools whenever a client's or employee's personal data goes into one, and the sign-up screen for a business plan usually hands it to you without you noticing. A data processing agreement, or DPA, is the short contract that says the tool may use your data only to do your job and must delete it when you ask.

TL;DR: A data processing agreement for AI tools is a written contract between you and the vendor covering any personal data you upload. Privacy law in the EU, the UK and California expects one whenever a vendor handles personal data for you. Business plans from the major AI vendors usually include it or let you sign it in a few clicks. Free and personal plans usually offer none. The test is simple: if the file contains a real person's details, use a plan with a DPA. If it contains none, you need no DPA. An AI document design tool like DocsAura works on one file at a time, so you control which of those two cases applies.

Most owners meet the term "DPA" at the worst moment: a client sends a security questionnaire, or a lawyer asks "do you have one with your AI vendor?" This article gives you the answer before that email arrives. It is general information and not legal advice, so treat it as a checklist to bring to your own adviser if the stakes are high.

What Is a Data Processing Agreement for AI Tools (and Do You Need One)?

A data processing agreement is a contract with three characters. You are the controller, the business that decides why personal data is used. The AI vendor is the processor, the company that handles the data for you. The agreement sets the rules between you.

Privacy law makes the contract mandatory in many places. Under the GDPR, Article 28(3) requires a written contract with any processor. The UK regulator, the ICO, lists the minimum terms: the processor acts only on your documented instructions, keeps the data confidential and secure, asks your permission before using sub-processors, helps with data subject requests and breach notices, deletes or returns the data when the contract ends, and allows audits. (source) California applies a similar idea to vendors that receive personal information from your business. Its regulations require a written contract with service providers that limits how they use the data. (source)

Two questions decide whether any of this applies to you:

1. Does the document contain personal data? Names, emails, phone numbers, addresses, salary figures, health details and client project notes tied to a named person all count.
2. Do your clients, staff or you sit in the EU, the UK or California? Many other US states have comparable laws, and a client's own contract often copies the same duty.

If both answers are yes, you need a DPA with that vendor. If the first answer is no, because the file is a template or a practice document, you need none. Our guide to GDPR and AI for business documents goes deeper on the law itself.

Which AI Plans Come With a DPA?

The plan you pick decides the answer, and this is where small businesses slip. A National Cybersecurity Alliance survey found that nearly 88% of small business owners already use AI tools, and 54% use them without formal guidelines. (source) Many of those owners sit on a free account with no DPA available at all.

Here is how the two best-known assistants handle it, per their own documentation:

Both vendors say they leave business-plan data out of model training by default (OpenAI, Anthropic). Anthropic's help center states plainly that the DPA covers commercial products and that consumer plans such as Claude Free and Pro are separate. (source) A law firm's guide to using AI at work makes the same point: business versions run on commercial terms that include a DPA, and an employee using a private ChatGPT account for a client document is processing data without one. (source)

What to do with this: look up the plan you actually pay for, not the brand. "We use ChatGPT" can mean a personal login with no DPA or a business workspace with one. The page on free vs paid AI tools for business documents explains the other differences between plan tiers.

How to Get and File a Data Processing Agreement in 15 Minutes

The paperwork is shorter than most owners expect. Run these five steps once per tool.

1. Confirm the plan. Open your account settings and read the plan name. If it says Free, Plus, Pro or Personal, a DPA is probably unavailable. Move work with personal data to a business plan or leave that data out.
2. Find the DPA. Search the vendor's site for "data processing addendum" or look in the legal, trust or privacy pages. Some vendors fold it into the terms you accepted at sign-up. Others give you a form.
3. Sign or confirm it. For a form, enter your company's legal name and a signatory. For an automatic one, note the date you accepted the commercial terms.
4. Save a dated copy. Put the PDF or screenshot in a folder called "AI vendors." A dated record is what a client's questionnaire asks for.
5. Skim the sub-processor list. The vendor names the other companies that touch your data. Act only if a name worries you; the list also shows which countries your data may pass through.

The whole thing takes about 15 minutes per vendor. A short written AI policy for your team can then point staff to the approved plans so nobody pastes client data into a personal account.

What We Found: The Three-Question DPA Test

We built a scoring shortcut called the Three-Question DPA Test from the Article 28(3) terms and the vendor documentation above. It turns the legal list into three yes-or-no checks you can run on any AI tool in two minutes:

1. Is my plan covered? The vendor offers a DPA for the exact plan I pay for.
2. Is the data use limited? The terms say my content is used to provide the service and not to train models by default.
3. Is there an exit? The terms say the vendor deletes or returns my data when I leave.

Three yes answers means the tool is fit for documents with personal data. One or two means limit it to documents with the personal details removed. Zero means use it only on practice files. Applied to the OpenAI and Anthropic business terms cited above, both score three out of three. The test checks the contract and leaves the vendor's security work to a separate review.

What a Signed DPA Leaves in Your Hands

A signed DPA is one layer of protection. Owners often treat it as a safety certificate, so it helps to know where it stops.

• Your choice of data. You decide what goes in. Removing names and figures before upload keeps the file out of scope altogether, and the checklist on what to redact before uploading a document to AI shows the fields to swap.
• Your own legal basis. Under the GDPR you still need a lawful reason to process the data and a way to tell your clients you use processors.
• Where the data travels. Data may be stored or processed abroad, and the DPA names the transfer safeguards. Read them.
• Tools reached through another platform. If you use Claude through a third-party service, that service's own terms govern the data. Anthropic says this directly for third-party access. (source)

A DPA works best next to a privacy check. The five-minute method in how to read an AI tool's privacy policy pairs well with the contract check above.

When You Can Skip the DPA Question Entirely

Plenty of everyday AI work involves no personal data, and for that work the DPA question disappears.

• A quote template with placeholder names.
• A service brochure describing what you offer to anyone.
• A pricing guide, a one-pager or a process document written about your own business.
• A practice document you invented to test a new tool.

Keeping documents in this category is the simplest compliance move a small owner can make. The article on whether it is safe to upload customer data to AI sorts documents into tiers so you know which bucket a file belongs in.

A Small Place to Start

DocsAura, an AI document design tool, takes one finished DOCX or PDF and returns a designed web page in about two minutes. It handles one job on one file at a time, so you decide exactly what it sees. Start with a document that has no personal data in it: a service menu, a price sheet, a made-up quote. That file needs no DPA, and you learn how the tool behaves before any client detail goes near it.

Pick one document you already have, remove the names, and drop it into DocsAura. In about two minutes you see the result, and you have made your first AI decision with the paperwork question already answered.