Signing a Data Processing Agreement With Your AI Vendor

Why an AI tool needs a data processing agreement

When an AI vendor processes personal data only on your behalf, such as summarising customer emails or answering chatbot enquiries, the PDPA usually treats it as a data intermediary. You remain responsible for the data. The PDPC's generative AI guidelines of July 2026 put the main responsibility on businesses that deploy AI tools, and our summary of what those guidelines mean for SMEs covers the details.

A data processing agreement (DPA, sometimes called a data processing addendum) is the contract that says what the vendor may do with your data, how it protects it, which sub-processors it uses, and what happens at the end. Our general guide to data processor agreements under the PDPA explains the clauses; this guide applies it to AI vendors.

Where the major AI vendors publish their terms

All four large vendors offer data processing terms for business customers. They differ in how you accept them.

Google's Workspace generative AI privacy hub confirms user prompts count as customer data under its Cloud Data Processing Addendum. Microsoft's page on enterprise data protection in Copilot says Copilot and Copilot Chat used by organisations are covered by its DPA and Product Terms. Note Microsoft's own caveat: web queries sent to Bing are handled separately.

What the PDPA adds: the transfer rules

Most AI processing happens outside Singapore. Section 26 of the PDPA, and regulations 10 to 12 of the Personal Data Protection Regulations 2021, require you to make sure an overseas recipient is bound by legally enforceable obligations to protect the data to a standard comparable to the PDPA.

• A contract counts if it requires comparable protection and specifies the countries and territories the data may go to.
• Certifications count too: for a data intermediary, APEC Privacy Recognition for Processors, APEC Cross-Border Privacy Rules, or their Global equivalents.
• Binding corporate rules only work between related companies, so they rarely apply to an SME using a vendor.
• Consent is possible but has conditions, including a written summary of how the data will be protected abroad.

The big AI vendors' DPAs are drafted around European law, with EU Standard Contractual Clauses. They usually point to a sub-processor list for where data goes. In practice, keep a copy of the DPA and the sub-processor list (which shows locations) together, and note why you consider the protection comparable. Our guide on where ChatGPT and other AI tools store data covers regional options.

What a good AI vendor DPA should contain

OpenAI's published DPA is a useful benchmark because it is public. It says OpenAI processes customer data only on your documented instructions, informs you of data subject requests, notifies personal data breaches without undue delay, flows obligations down to sub-processors, and returns or deletes data at the end.

Six questions to ask any AI vendor

Smaller AI tools, such as chatbot builders, meeting note-takers and AI writing apps, often sit on top of OpenAI, Anthropic or Google models. They need their own DPA with you, and you should know which model provider they pass data to.

1. 1

   Do you offer a DPA, and on which plan?

   Get the document or link, and check it applies to the plan you are buying, not only an enterprise tier.

2. 2

   Do you or your model provider train on our data?

   The answer should be no by default, in the contract, not just in marketing copy.

3. 3

   Which model providers and sub-processors receive our data?

   Ask for the sub-processor list, including the AI model vendor.

4. 4

   Where is the data stored and processed?

   Countries matter for PDPA transfer rules. Ask if a regional option exists.

5. 5

   How long do you keep prompts, files and logs?

   Look for a stated retention period and an admin setting to shorten it.

6. 6

   How will you tell us about a breach?

   Ask for the notification commitment and contact. The PDPA's breach notification timelines run from when you become aware.

Do it yourself or get help?

Collecting the DPAs for the two or three AI tools you actually use is a half-day job. The harder part is the surrounding paperwork: knowing what personal data you hold, which vendors touch it, and having a breach plan. This is general information, not legal advice; for unusual data or contracts, ask a lawyer.

Our PDPA Compliance Pack (S$690) includes a website privacy policy, a personal data inventory from our online questionnaire, a staff data protection policy, DPO appointment notes, and a data breach response plan with a notification checklist. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront, send the brief in writing and follow progress on your order page.