Does an AI Visibility Platform Need a Data Processing Agreement for EU Customers?

When is an AI visibility platform processing personal data?

Many platforms process some personal data even if their core purpose is brand tracking. Professional services, healthcare and local businesses often track questions about named people.

What must a GDPR Data Processing Agreement contain?

Article 28 GDPR requires the contract to set out the subject matter, duration, nature and purpose of processing, the types of personal data and the categories of people concerned. It must also oblige the processor to:

• process personal data only on the customer's documented instructions;
• ensure people handling the data are bound by confidentiality;
• apply appropriate security measures, as required by Article 32;
• use sub-processors only with the customer's authorisation, under equivalent terms;
• help the customer respond to data subject rights requests;
• assist with security, breach notification and data protection impact assessments where relevant;
• delete or return personal data at the end of the service;
• provide information and allow audits to demonstrate compliance.

Most established software vendors publish a standard DPA that customers accept alongside their terms.

How do AI model providers fit in as sub-processors?

An AI visibility platform sends prompts to AI models either through their APIs or by running them in the consumer apps through automated browser sessions. Through an API, the model provider can act as a sub-processor under business terms. Through a consumer app, the provider's consumer terms apply, which are not a processor contract and may allow conversations to be used for training, so ask the vendor which method it uses for each engine and how it keeps personal data out of those prompts. If prompts or answers sent through APIs contain personal data, those providers are sub-processors, and the platform should:

• list them in its sub-processor list, with their location and purpose;
• have terms with them that meet GDPR requirements;
• tell customers how prompts and answers are handled, including retention and whether they may be used for training.

Major model providers' business API terms generally state that customer data is not used to train their models by default, but terms differ and change, so check each provider listed. Whether a vendor itself trains on customer prompts is covered in whether an AI visibility vendor uses customer prompts to train its models.

What about transfers outside the EU?

Many AI visibility platforms and model providers process data in the United States or elsewhere. Transfers of personal data out of the EU need a legal basis, typically one of:

• the EU-US Data Privacy Framework, for US companies certified under it, based on the European Commission's 2023 adequacy decision;
• Standard Contractual Clauses, the Commission's 2021 model clauses, usually built into the DPA;
• an adequacy decision for other countries.

For UK customers, the UK GDPR applies, with its own transfer tools such as the UK Addendum to the Standard Contractual Clauses.

What should EU customers check before signing?

1. A DPA is available and covers the processing you will do.
2. The sub-processor list names hosting, model providers and search data providers, with locations.
3. Data location and transfer mechanism are stated.
4. Retention periods for prompts, answers and uploaded data, and deletion on request.
5. Training use: whether the vendor or its providers use your prompts or answers to train models.
6. Security: certifications such as ISO 27001 or a SOC 2 report, and breach notification commitments.
7. Data minimisation: whether you can avoid entering personal data, for example by tracking roles rather than named individuals.

If you track questions that name individuals, consider whether that is necessary, and record the purpose in your own records of processing. The separate question of whether such tools fall under the EU AI Act's high-risk rules is covered in whether an AI visibility monitoring tool is a high-risk system under the EU AI Act.

What do people ask about DPAs and AI visibility tools?

Do we need a DPA if we only track our brand name?

If no personal data is processed on your behalf, Article 28 may not apply to that use. But accounts, logs and any uploaded data usually involve some personal data, so most vendors offer a DPA anyway.

Who is responsible if a model provider mishandles data?

The platform remains responsible to you for its sub-processors under the DPA, and you remain responsible as controller for choosing a compliant platform.

Can we use a US-based tool?

Yes, with an appropriate transfer mechanism, such as the Data Privacy Framework or Standard Contractual Clauses, and suitable safeguards.

Should we ask for a data protection impact assessment?

If you process sensitive data or track individuals at scale, assess the risk; the vendor should help with information for it.