GDPR and data processing agreement (DPA)

When a business in the EU uses an AI phone assistant, it remains responsible for its callers’ data as the controller. The provider processes the data on its behalf. For this the GDPR requires a contract that lays down subject matter, duration, type of data, the right to give instructions, security measures and the use of sub-processors. In Germany this contract is known as the “AV-Vertrag” or AVV.

Four points matter most in a review: which sub-processors are involved, in which countries data is processed, on what basis data is transferred to countries outside the EU, and how long recordings and transcripts are kept. The statement “GDPR compliant” is no substitute for this review. With particularly sensitive data, for instance in medical practices or law firms, professional secrecy obligations come on top.