Search ⌘K Start a project →

Security & governance

Data Processing Agreement (DPA)

Also known as DPA

A DPA is the contract naming a vendor as a processor of personal data.

It sets terms for retention, subprocessors, breach notification, and deletion.

Routing personal data to a third-party model API almost always brings that provider into this category.

Reviewers check that the specific model provider and product is actually named, rather than covered by "AI features."

AI Security Review

← Back to the full glossary

Related terms

Data Residency Data residency is where data is physically processed and stored, not where users are located. AI Register An AI register is a current list of every system that touches a model.

More in Security & governance

Red Teaming Red teaming is deliberately attacking your own AI system to find what breaks first. High-Risk AI System A high-risk AI system is one classified as carrying enough decision impact to trigger heavier compliance. Human Oversight Human oversight is a checkpoint where a person can meaningfully approve, reject, or intervene. System Card A system card is a short document stating an AI system's purpose, limits, and owner.

Source: https://customlabs.io/glossary/data-processing-agreement/