When you need a data processing agreement with a chatbot vendor
A chatbot on your website stores and processes what your visitors type, on your behalf. You decide why that happens and with which tool, so you are the controller under Article 4(7) GDPR. The vendor processes the data for you, which makes it your processor under Article 4(8). Article 28(3) then requires a contract that binds the vendor to you and covers a fixed list of points, and Article 28(9) says it must be in writing, "including in electronic form".
The personal data involved is wider than the chat window suggests:
- Visitors: every message and answer, whatever they type about themselves, contact details if your chat asks for them, files they send, and technical data such as IP addresses if the vendor logs them.
- Your own staff: the people who sign in to the dashboard and read conversations.
- People named in your sources: a team page or a price list with a contact person, once the chatbot has learned from it.
The European Data Protection Board (EDPB), the EU body in which the national data protection authorities sit together, says that having no such contract is an infringement in itself, that controller and processor are both responsible for putting one in place, and that an authority can fine both (Guidelines 07/2020, paragraph 103). A breach of Article 28 falls under Article 83(4)(a): fines of up to EUR 10 million or, for a company, 2% of its worldwide annual turnover, whichever is higher.
If an agency builds the chatbot for you, the chain has two links: you and the agency, then the agency and the platform. Agency chatbots and GDPR roles covers that chain.
What Article 28 requires, point by point
Article 28(3) lists what the contract must contain. The EDPB adds that the agreement "should not merely restate the provisions of the GDPR" but say concretely how each point is met (Guidelines 07/2020, paragraph 112).
| Article 28 | What the text requires | What it means for a chatbot |
|---|---|---|
| (3), first sentence | Subject-matter, duration, nature and purpose, type of personal data, categories of data subjects, your rights and obligations | A description of your chatbot service: which data, whose, for how long |
| (3)(a) | Processing only on your documented instructions, transfers to third countries included | Your settings are instructions; no move to a provider outside the European Economic Area (EEA) that you did not agree to |
| (3)(b) | Staff committed to confidentiality | Everyone who can read conversations, support included |
| (3)(c) | The security measures of Article 32 | Encryption, access control, backups and testing, in an annex |
| (3)(d) | The sub-processor rules of 28(2) and (4) | The hosting, database, model and e-mail providers behind the chatbot |
| (3)(e) | Help with data subjects' requests | Finding, exporting and deleting one visitor's data |
| (3)(f) | Help with Articles 32 to 36: security, breaches, impact assessments, prior consultation | Breach notice, and the facts for your data protection impact assessment (DPIA) |
| (3)(g) | Deletion or return at the end, at your choice, existing copies deleted | Export, then deletion, copies at sub-processors included |
| (3)(h) | Information and audits, inspections included, and a warning if, in the vendor's view, an instruction breaks data protection law | Reports, a real audit right, and a duty to speak up |
| 28(2) and (4) | Written authorisation of sub-processors, notice of changes with a chance to object, the same obligations down the chain, the vendor fully liable to you | A sub-processor list with notice and objection, and no gap in the chain |
Article 28(10) closes the loop: a processor that, in breach of the GDPR, determines the purposes and means of a processing itself is considered a controller for that processing. That is the legal hook for the training question below.
The checklist: 20 points, why they matter, and the red flags
Use it on any vendor's agreement, ours included. It is not exhaustive: adapt it to your case, and have your adviser review the wording where much depends on it. A red flag does not make an agreement unlawful by itself; it is a question to ask before you sign. Paragraph numbers refer to the EDPB Guidelines 07/2020 unless another document is named.
| # | Check | Why it matters | Good answer | Red flag |
|---|---|---|---|---|
| 1 | Parties and roles | Article 28 binds the processor to you, the controller | Both companies named; you the controller, the vendor the processor of visitors' conversations | The vendor calls itself a controller of chat data, or keeps a role "for its own purposes" |
| 2 | Documented instructions | Article 28(3)(a) | Your settings and the service description as instructions; legal exceptions limited to EU or member-state law, with notice to you first | Only "unless required to do so by law or binding order of a governmental body", for data processed outside the EEA: "highly unlikely to suffice", says the EDPB (Opinion 22/2024, paragraph 116) |
| 3 | Purpose | A processor may not process for purposes of its own (paragraph 81) | Only to run your chatbot and support you | "To improve our products and services", analytics or benchmarking on your conversations |
| 4 | Data and data subjects | To be described specifically, such as "visitors", not as "personal data pursuant to Article 4(1) GDPR" (paragraph 114) | Messages, files, contact details and logs; visitors, your staff, people in your sources; a note that visitors may type sensitive data | Categories copied from the GDPR's definitions |
| 5 | Duration | Required by Article 28(3) | The contract term plus the deletion period after it | None, or "as long as necessary" |
| 6 | Confidentiality and support access | Article 28(3)(b); staff access only where "strictly necessary" (Decision 2021/915, Clause 7.4(b)) | Staff bound to confidentiality; support opens a conversation only to help you or fix a fault, and access is logged | Unlimited internal access, or no word on support |
| 7 | Security measures | Article 32; to be described "concretely and not in a generic manner" (Decision 2021/915, Annex III) | An annex with encryption, access control, logging, backups, restore tests and a review cycle | "Industry-standard security" and no annex |
| 8 | Sub-processor list | Article 28(2); each one's location, task and safeguards (paragraph 152), and all of them readily available to you (Opinion 22/2024, paragraph 31) | Name, address, purpose, country and transfer safeguard for each, the model and embedding providers included | "Trusted third parties", or no AI model provider on the list |
| 9 | Notice of changes and objection | Article 28(2); access to a list that changes now and then is not enough: each new one must be flagged (paragraph 128, footnote 54) | Written notice a stated number of days ahead (the Commission's clauses leave that period blank), a right to object, and what follows an objection | "Check our website for updates", or no right to object |
| 10 | The same obligations down the chain | Article 28(4): the vendor stays fully liable to you for its sub-processors | The same obligations imposed by contract, and a copy on request (Decision 2021/915, Clause 7.7(c)) | Liability for sub-processors excluded |
| 11 | Transfers and the SCC module | Chapter V (Articles 44 to 46) binds processors too | For each recipient outside the EEA: an adequacy decision, or Module 2 clauses (vendor outside) or Module 3 clauses (vendor to sub-processor) | No mechanism named, or the 2010 clauses, which stopped counting as safeguards after 27 December 2022 |
| 12 | No training on your data | Training for the vendor's own benefit is a purpose of its own (Article 28(10)) | Neither the vendor nor any sub-processor trains or improves models with your conversations, sources or files | An opt-out hidden in settings, "anonymised data may be used", or silence about the model provider |
| 13 | Retention at the model provider | It receives conversation text with every answer, and what it keeps does not necessarily go when you delete the conversation | Provider named, retention stated (none, or a number of days for abuse monitoring), and the setting that applies to your traffic | "We do not store your prompts", said of the vendor only |
| 14 | Model routing | Article 28(3)(a) covers transfers, and a model gateway may retry with another provider when one fails | Which regions and companies may serve your requests, whether failover can leave them, and whether an EU-only setting is on | "Hosted in the EU" that covers the database but not the model calls |
| 15 | Logs about visitors | Server and abuse logs can hold IP addresses and message text | What is logged, for how long, and whether IP addresses are stored at all | No word on logs |
| 16 | Breach notice | Article 33(2): "without undue delay". The EDPB suggests a timeframe in hours, a contact point and minimum content (paragraph 136) | A maximum in hours, a named contact, the content of Article 33(3), and a first notice with what is known, completed later | "In accordance with applicable law", or notice only once the vendor's investigation is over |
| 17 | Help with requests and DPIAs | Article 28(3)(e) and (f); your one-month deadline (Article 12(3)) does not stretch for a slow vendor (paragraph 132) | Tools to find, export and delete one visitor's data; requests passed to you promptly and not answered by the vendor (Decision 2021/915, Clause 8(a)) | Help only as a paid service, with no timeline |
| 18 | Deletion, return and backups | Article 28(3)(g); deletion confirmed within an agreed timescale (paragraph 141) | Export in a usable format, deletion within a stated number of days, written confirmation, and how long backups keep the data | No period, or backups not mentioned |
| 19 | Audits, reports and certifications | Article 28(3)(h); certifications such as the ISO 27000 series can serve as evidence (paragraph 95) and can inform your decision on an audit (Decision 2021/915, Clause 7.6(c)) | Recent reports whose scope covers the chatbot service; audits at reasonable intervals; the final choice of auditor is yours (paragraph 144) | Fees that leave the audit right on paper (paragraph 145), or a badge with no scope |
| 20 | Liability | Where both of you are responsible for a damage, a visitor can claim all of it from either of you (Article 82(4)). A cap between you and the vendor does not limit that claim; it can only affect what you get back | A cap that does not shrink the vendor's own data protection breaches to a token sum | One low cap for everything, breaches of the agreement included |
Sub-processors and transfers: which SCC module applies
Two sets of standard contractual clauses exist, and agreements often mix them up. The EDPB points out that clauses for Article 28 "are not the same as" the clauses for transfers under Article 46 (Guidelines 07/2020, footnote 44).
- Decision (EU) 2021/915 is the Commission's template for the Article 28 contract itself. Its four annexes make a checklist of their own: the parties, a description of the processing, the security measures and the sub-processors. It does not cover transfers to third countries.
- Decision (EU) 2021/914 covers transfers outside the EEA, which is the EU plus Iceland, Liechtenstein and Norway. It works in modules: Module 2 for a transfer from a controller to a processor, Module 3 from a processor to a sub-processor.
Which one concerns you depends on where the vendor and its sub-processors are:
| Situation | What covers the transfer | Who signs |
|---|---|---|
| Vendor and all its sub-processors in the EEA | There is no transfer; the Article 28 agreement is enough | You and the vendor |
| Vendor in the EEA, a sub-processor outside it, such as a model or e-mail provider in the United States | An adequacy decision, or Module 3 clauses between the vendor and that sub-processor | The vendor and its sub-processor; you authorise the sub-processor and should be able to see the documentation |
| Vendor outside the EEA | An adequacy decision, or Module 2 clauses between you and the vendor, often attached to its agreement | You and the vendor |
In the second case, if your agreement is built on the Commission's Article 28 clauses, you agree in advance that the vendor and its sub-processor may use the transfer clauses (Decision 2021/915, Clause 7.8(b)). The EDPB adds that the vendor prepares the transfer documentation, that you should assess it and be able to show it to an authority, and that you may rely on what the vendor gives you, adding to it where needed (Opinion 22/2024).
Warning. The Commission repealed the 2010 standard contractual clauses with effect from 27 September 2021, and contracts based on them counted as safeguards only until 27 December 2022 (Decision 2021/914, Article 4). An agreement that still refers to Decision 2010/87/EU is out of date.
Training, retention and routing: the clauses a chatbot needs
This is where an AI chatbot differs from ordinary software. Three questions decide what happens to a visitor's words after the answer.
Does anyone train on the conversations? A processor may only process for your purposes. If the vendor, or the company behind the model, uses conversations to improve its own models, it decides a purpose of its own, and Article 28(10) treats it as a controller for that processing (EDPB Guidelines 07/2020, paragraph 81). Ask for one explicit sentence that covers the vendor and every sub-processor. Model providers publish their own position: OpenAI's API documentation, for example, says that data sent to its API has not been used to train its models since 1 March 2023, unless the customer opts in (read 25 October 2026).
What does the model provider keep? To write an answer, the model typically receives the recent conversation and the passages found in your sources, and some providers keep that text for a while. OpenAI's documentation says its abuse-monitoring logs can contain prompts and responses and are kept for up to 30 days by default (longer where the law requires it or to protect its services or others from harm), its embeddings endpoint included, and that zero data retention needs OpenAI's prior approval (read 25 October 2026). Cortecs, a European model gateway, lists 0 days for every provider in its retention table except Microsoft, at 30 days, and lets a customer restrict routing to endpoints that keep nothing (read 25 October 2026). So ask which provider, which retention period, and which setting applies to your traffic.
Where can a request be routed? A model gateway picks a provider for each request and can retry with another when one fails. Cortecs documents exactly that, together with a setting, eu_native, that limits routing to providers "based and regulated within the EU" and is off by default. Without it, Cortecs says, European data residency is still ensured, "but data might be processed by entities of non-EU companies", and it names Microsoft, Google and AWS (read 25 October 2026). Server location alone does not settle the question: ask which regions and which companies can serve your requests, and whether failover can leave them. A retrieval chatbot also sends text to an embedding model to turn it into search vectors, sometimes at another company than the one that writes the answers. Does a chatbot need EU hosting? goes through each of these layers.
Where to find a vendor's DPA, and what "on request" means
Vendors offer their data processing agreement in one of three ways:
- A public page or PDF that, by its own wording, forms part of the terms you accept when you sign up.
- Inside the terms of service you accept. Cortecs, for example, says its agreement is integrated into its terms.
- On request: the vendor sends you the agreement to sign. That is how ChatterLab does it.
All three can work. Article 28(9) accepts electronic form, and the EDPB notes that some service providers build their agreements into standard terms (Guidelines 07/2020, paragraph 108). What matters is the content, and proof of which version applies: the EDPB recommends the signatures your contract law requires (paragraph 101), and you should keep a dated copy of what you accepted.
"On request" is fine, as long as you request it before you sign the main contract. The EDPB is plain that a small customer's weak negotiating position does not justify accepting terms that do not comply: if you accept them and use the service, the responsibility is yours (paragraph 110). The same paragraph covers later changes to such terms; see the questions below.
Signing is not the end of it. Using only processors with sufficient guarantees is a continuing duty, to be checked again at appropriate intervals (paragraph 99). A yearly look at the sub-processor list and the security annex is one way to keep it.
An email to send the vendor before you sign
Copy it, adjust it to your case, and keep the answers with the agreement.
Subject: Data processing agreement for your chatbot
Hello,
Before we put your chatbot on our website, please send us your data
processing agreement with all its annexes (description of the processing,
technical and organisational measures, list of sub-processors) in the
version that would apply to us, and answer these questions:
1. Which sub-processors receive our visitors' conversations, files or our
sources? For each: purpose, country, and the transfer mechanism
(adequacy decision, or which module of the standard contractual clauses).
2. Which company runs the model that writes the answers, and which one
creates the search vectors? Can requests be routed to another provider
or region, for example on failover, and can that be limited to the EU?
3. Do you or any sub-processor use our conversations, sources or files to
train or improve models? Where does the agreement say so?
4. Does the model provider keep prompts and answers after replying? For
what purpose and for how long? Does zero data retention apply to us?
5. How far in advance, and how, will you tell us about a new
sub-processor, and what happens if we object?
6. Within how many hours will you notify us of a personal data breach,
and who is our contact point?
7. Who on your side can read our conversations, in which cases, and is
that access logged?
8. When the contract ends, how do we export our data, within how many
days is it deleted, backups included, and will you confirm it in writing?
Thank you, and kind regards
How ChatterLab answers the checklist
ChatterLab is a chatbot vendor too, so here are its answers, most of them from its data and privacy documentation. Where the public documentation says nothing, the table says so.
| Point | ChatterLab's answer |
|---|---|
| The agreement | Sent on request: write to management@sri-group.eu. There is no agreement to sign inside the product. |
| Roles | For your visitors' conversations you are the controller and ChatterLab is your processor. With an agency, the client is the controller, the agency its processor, and ChatterLab the agency's processor. |
| Purpose and training | Conversations are processed to run your agent and for nothing else. ChatterLab does not train models on your content or conversations, and OpenAI, which turns text into search vectors, does not use this data to train its models. |
| Sub-processors and places | Vercel, the application: Frankfurt, Germany. Neon, the database: EU. Cloudflare R2, files: EU jurisdiction. Cortecs, writing answers and the grounding check: see the next row. OpenAI, search vectors: United States. Resend, e-mail: United States, with the mail leaving from servers in the EU (Ireland). Clerk for sign-in and Stripe for payments, which concern you rather than your visitors. |
| The model gateway | Cortecs, a European model gateway, receives with each answer your instructions, the page the visitor is on, the passages found, the recent conversation and any file sent with the question. Cortecs says that by default all requests remain within Europe and data is not used for AI training. ChatterLab requests Cortecs' EU-only routing (eu_native) when it reads a visitor's scan, not for answers or the grounding check. |
| Transfers | Resend: the EU-US Data Privacy Framework and standard contractual clauses. OpenAI: its data-processing terms; the public documentation does not name the transfer mechanism, so ask for it (point 11). |
| Logs about visitors | IP addresses are not stored. For the message limit, a fingerprint of the address is kept for 24 hours. |
| Retention and deletion | Conversations stay until you delete them, or the agent; nothing deletes them automatically. Deleting an agent removes its conversations and every uploaded file. Like anything deleted from the database, conversations stay a while longer in the backups the database host keeps for restoring. |
| Return | Conversations export as a PDF from Activity, and can be read over the API. |
| Visitors' requests | You find, export and delete a conversation in Activity, and leads and tickets each have their own Delete. ChatterLab does not answer requests in your place. |
| Not in the public documentation | The breach notice period, audit terms, liability, when ChatterLab's staff may read conversations, and the settings of ChatterLab's own accounts at Cortecs and OpenAI that apply to every request, such as zero data retention. Ask for these with the agreement. |
| Certifications | None claimed. Security describes the measures instead. |
Two steps run outside the EU, search vectors and e-mail, and we name them because your own privacy notice has to. The GDPR page has the summary. You can try the product on the free plan; before real visitors' conversations go through it, ask for the agreement.
Questions about chatbot data processing agreements
Do I need a data processing agreement for a free chatbot plan?
Yes, once real visitors use it. Article 28 turns on what the vendor does with personal data, not on the price: a free plan that stores and processes your visitors' conversations on your behalf makes the vendor your processor all the same. The EDPB adds that the relationship can exist without a written contract, and that the missing contract is then a breach of Article 28(3).
Is a click-through or online DPA valid?
It can be. Article 28(9) requires the contract in writing, "including in electronic form", so an agreement accepted online can meet the form requirement. The EDPB recommends including the signatures your contract law requires, so that you can prove the agreement is in force. What decides is the content: every point of Article 28(3) must be covered. Keep a dated copy of the version you accepted.
Do I need to sign standard contractual clauses separately?
Usually not, if the vendor is based in the EEA. When it uses a sub-processor outside the EEA, the transfer is the vendor's, and the vendor concludes Module 3 of the Commission's clauses with that sub-processor, unless an adequacy decision covers it. If the vendor itself is outside the EEA, you need a mechanism with it, usually Module 2, which can sit inside its agreement. Either way, ask which mechanism covers each transfer.
What can I do if the vendor will not sign a DPA?
Do not use it for real visitors. Without a contract that meets Article 28, the EDPB treats the processing as an infringement on both sides, and a small customer's weak negotiating position is no excuse. Ask once more and offer the Commission's standard clauses for controllers and processors (Decision 2021/915) as the basis: the EDPB says they can help rebalance the negotiation. If the answer is still no, choose another vendor.
Can the vendor change the DPA or its sub-processors on its own?
Not by quietly editing a web page. The EDPB says a change to an agreement in standard terms should be notified to you directly and approved by you, leaving the vendor some leeway over practical details such as its choice of hardware or software, and that publishing the change on its website is not compliant with Article 28. For a new sub-processor under a general authorisation, Article 28(2) requires notice in advance and a chance to object, and the vendor has to flag each addition.
How do I find out which sub-processors a chatbot uses?
Look in the agreement's annex or on the vendor's sub-processor page, and check that it names the company behind the AI model and the one that creates the search vectors. The EDPB expects the vendor to give you the name, address and contact person of every sub-processor proactively and keep it up to date (Opinion 22/2024). Your privacy notice needs it too: it names the recipients of visitors' data, or their categories (Article 13(1)(e)). A privacy notice for your chatbot shows how to word that.
Sources
- Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 4, 12, 13, 28, 32 to 36, 44 to 46, 82 and 83, EUR-Lex, read on 25 October 2026.
- Commission Implementing Decision (EU) 2021/915 on standard contractual clauses between controllers and processors, EUR-Lex, read on 25 October 2026.
- Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries, EUR-Lex, read on 25 October 2026.
- Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version 2.1, European Data Protection Board, read on 25 October 2026.
- Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s), European Data Protection Board, read on 25 October 2026.
- Data controls in the OpenAI platform, OpenAI, read on 25 October 2026.
- Routing Concept, Cortecs, read on 25 October 2026.
- Sovereign Cloud, Cortecs, read on 25 October 2026.
- Zero Data Retention (ZDR), Cortecs, read on 25 October 2026.
- Data Governance & Controls, Cortecs, read on 25 October 2026.
How this was made: drafted with AI, then checked against how ChatterLab actually works and against the sources listed in the article. Spotted an error? Write to management@sri-group.eu.