# AI clauses checklist for data processing agreements

> For reference purposes only. Not legal advice. Draft for review by a qualified professional.

> How to use this template. Topics to check when personal data goes to an AI supplier. A checklist of topics, not a contract. Replace every [placeholder], delete guidance notes and have a qualified professional review the result. Template version 1.0, last reviewed 2026-10-03. Certainty: simplified.

## Roles

Who is controller and who is processor for each data flow?

[Enter your text here]

## Purpose limits

Is the supplier limited to your instructions, including for model training?

[Enter your text here]

## Sub-processors

Which are used, and how are changes notified?

[Enter your text here]

## Transfers

Where is data processed and under what safeguards?

[Enter your text here]

## Retention and deletion

Retention periods, logs and deletion on exit.

[Enter your text here]

## Security and breach notice

Measures and notification timing.

[Enter your text here]

## Assistance

Help with rights requests and impact assessments.

[Enter your text here]

## Certainty notes

- Simplified: a general starting point. Rules differ by region.

> For reference purposes only. This site offers general guidance for learning and planning; it is not legal advice and creates no lawyer-client relationship. Rules change often, so check the primary sources and qualified counsel before you act.