DPA checklist for LLM API vendors under GDPR Article 28

If you send personal data of EU or UK individuals to an LLM API, the provider is usually your processor, and GDPR Article 28 requires a contract with specific terms. This checklist lists what the article says that contract must contain so you can compare it with the vendor's data processing terms. It is not legal advice.

First, is the vendor a processor

If the provider handles personal data only on your instructions, to provide the service to you, it is acting as a processor. If it also decides its own purposes for that data, such as training its own models by default, the picture changes. Read the terms for what they say about use of your inputs and outputs. Ask a lawyer when the answer is unclear.

What Article 28 says the contract must set out

The text of Article 28(3) says the contract must state the subject matter and duration, the nature and purpose of processing, the types of personal data and the categories of data subjects, and the obligations and rights of the controller. It must also require the processor to do the following.

1. Process only on documented instructions from you, including for transfers outside the EU, unless law requires otherwise.
2. Bind staff to confidentiality for people authorized to process the data.
3. Take the security measures required by Article 32.
4. Follow the sub-processor conditions in paragraphs 2 and 4.
5. Help you respond to data subject requests, such as access and deletion.
6. Help you meet your obligations under Articles 32 to 36, which cover security, breach notification and impact assessments.
7. Delete or return all personal data at the end of the service, at your choice, and delete copies unless law requires storage.
8. Provide information to show compliance and allow and contribute to audits, including inspections.

The processor must also tell you at once if it thinks one of your instructions breaks data protection law.

Sub-processors

Paragraph 2 says the processor needs your prior written authorization to use another processor. That can be specific or general. Under a general authorization, the processor must tell you of planned additions or replacements and give you the chance to object. Paragraph 4 requires the same obligations to pass down to the sub-processor, and the first processor remains fully liable to you if the sub-processor fails.

For an LLM API, check who the sub-processors are, such as cloud hosts, and how you get notice of changes. See what AI startups should publish about sub-processors.

Questions specific to LLM APIs

• Are inputs and outputs used for training by default? One provider's documentation states its API data is not used for training unless you opt in, but check the current terms of yours.
• How long are prompts retained for abuse monitoring, and can you reduce that? See zero data retention: what to ask.
• Where is data processed, and is there a regional option?
• Is there a breach notification timeline in the contract?
• What happens to fine-tuned models and uploaded files when you leave?

Keep your own records

Article 28 is about the vendor contract. You also need your own record of processing. See the Article 30 records template. Security terms should tie back to Article 32, which lists measures such as encryption, resilience and regular testing.

Quick check

Sources

• GDPR Article 28: Processor
• GDPR Article 32: Security of processing
• Provider documentation: data controls

Last reviewed: 19 October 2026.