AI Data Processing Agreements for Law Firms: Model and Marketplace Review

Map the contract stack first

Do not assume one processor role

The same vendor may process customer content under a DPA while handling account, security, billing or telemetry data under separate controller terms. Third-party tools may sit outside the model provider’s services. Record the role, purpose, data category and governing document for each flow.

Eight fields to review

1. Permitted purpose and instructions.
2. Training or product-improvement use.
3. Operational, safety and feature-level retention.
4. Human access and review.
5. Subprocessor and marketplace chain.
6. Cross-border processing and available transfer mechanism.
7. Deletion, return and backup treatment.
8. Audit, incident and change evidence.

What public terms demonstrate

Google distinguishes paid and unpaid Gemini API data use and incorporates a processor DPA for paid services. Anthropic’s commercial terms state that customer content is confidential information and is not used to train models, while separate guidance sets Covered Model retention. OpenAI’s services agreement and technical data-controls documentation describe another product and exception structure. These differences make a one-line “enterprise AI is private” representation inadequate.

DPA responsibility matrix

Build the evidence room before negotiating

Start with documents the buyer can keep and recheck: the executed order form, incorporated service terms, DPA, service-specific terms, current subprocessor list, security reports made available under the deal, data-residency statement, retention schedule, model and endpoint documentation, incident process and product change notices. Add the firm’s own architecture, permission map and deletion test. The purpose is not to collect badges. It is to connect each representation to the exact surface that will process the material.

Record the document version and access date. Living web terms can change, and a downloaded PDF can become stale. If a negotiated amendment overrides a public term, preserve the precedence rule and the people who can interpret it. If the documents conflict, do not resolve the issue by choosing the most reassuring sentence. Route the conflict to the named reviewer.

Translate the workflow into processing instructions

“Use AI for legal work” is too broad to evaluate. Describe the permitted input, operation and destination: for example, extract named fields from approved public documents into a review queue, or compare a draft against a controlled precedent without sending the output externally. Then list prohibited data and actions. This operational description lets privacy, procurement and security compare the contract against the real service instead of an imagined generic chatbot.

For agentic or connected workflows, include tool calls and external systems. A model may process one copy while a connector, search service, tracing platform or embedded legal vendor handles another. Each hop needs a purpose, role, retention rule, access path and governing document.

Follow the subprocessor and marketplace chain

A cloud marketplace can change the contracting entity, billing relationship, hosting architecture, support route and applicable terms. A legal product may add the model provider as a subprocessor while also using identity, storage, logging and analytics vendors. Ask for the current chain that applies to the purchased product, not the provider’s global company list.

Change notice matters because the chain can evolve after signature. Record how notice is delivered, who receives it, the review period and what operational options exist if a new provider is not acceptable. A theoretical right that no one monitors is not an operating control.

Connect incident language to the response workflow

The contract record should identify what events trigger notice, which channels and contacts are used, what initial facts the provider supplies, how updates are delivered, what evidence can be preserved and who coordinates containment, client assessment and required reporting. The correct legal deadline depends on the facts and jurisdiction, so this guide does not prescribe a universal number. It requires the firm to know whether the contractual path supports its reviewed response plan.

Test the contact path before an incident. Confirm that the security, privacy and matter owners can reach the provider, that account and request identifiers are available, and that logs can be preserved without expanding access. A tabletop exercise exposes gaps that a clause list cannot.

Test deletion, return and exit

Termination language should be evaluated against product behavior. Can the firm export prompts, source references, outputs, configuration and audit records in a usable format? Which customer actions delete files, projects, caches and accounts? Which backups or legal holds create exceptions? Which downstream copies remain in firm systems? Run the test with non-sensitive data and retain the result.

Exit also includes model replacement. If a vendor swaps a model, deprecates an endpoint or changes a feature, the firm needs notice, a regression test and a rollback or migration route. Treat those lifecycle controls as part of the processing arrangement, not an engineering footnote.

Review no-training language in context

A no-training restriction answers whether customer content may be used to develop or improve models. It does not by itself answer how long the service keeps prompts, whether safety reviewers can access flagged content, whether files or caches persist, which third parties receive tool arguments, or whether the customer’s own application stores a trace. Keep these as separate rows so a strong answer in one field does not conceal an unresolved field elsewhere.

The review should also distinguish customer content from feedback, telemetry, account data and content sent through third-party features. Public terms can assign those categories different treatment. Confirm whether an opt-in, support request or evaluation program changes the default. The operational control is the approved account and configuration, not a memory of the vendor’s headline promise.

Map location, residency and transfers without shortcuts

Ask where the relevant categories are stored and processed, which regions the purchased surface supports, whether a feature changes the route, and what customer choice or project configuration selects the region. Separate storage location from processing location and support access. A residency statement for one enterprise product should not be copied to a consumer account, API endpoint, marketplace or connector.

For cross-border questions, retain the provider’s current locations, subprocessor information and contractual mechanism alongside the firm’s matter and client requirements. The correct conclusion depends on the parties, data, route and applicable law. The DPA review should present the evidence to counsel rather than declaring that one named framework automatically makes every transfer acceptable.

Connect confidentiality language to access controls

Contractual confidentiality duties matter, but the operating record should show who can access customer content, under what trigger, with which authorization, and whether access is logged. Distinguish ordinary support, abuse or safety review, security response, legal preservation and customer-authorized troubleshooting. Ask what the customer can see in audit logs and how access evidence is requested.

Do not state that a vendor agreement automatically preserves attorney-client privilege or work-product protection. Those are legal conclusions that depend on facts and jurisdiction. The practical contribution of the DPA review is narrower: document the vendor relationship, purpose limitation, access restrictions, confidentiality duties, human review path and firm controls so the assigned lawyer can evaluate the issue.

Turn assurance documents into testable controls

Certifications and independent reports can support diligence, but their scope, period, product and exceptions matter. Record which service is covered, the report date, relevant control description and any customer responsibilities. Do not translate a logo on a trust center into a claim that every model, connector or feature was tested.

Pair assurance evidence with product tests the buyer can run: least-privilege access, export, deletion, administrator offboarding, log availability and incident contact. Note what the test can prove. A successful deletion exercise shows the documented path worked for that canary project on that date; it does not prove the absence of every backup or legally preserved record.

Prioritize unresolved risk instead of collecting clauses

Use the workflow and data classification to rank open issues. A public-document summarizer with no write access creates a different review burden from an agent that can read confidential repositories and update external systems. Focus negotiation and technical controls on the data, action and failure paths that would be material for that workflow.

The final decision record should list accepted controls, compensating controls, rejected uses and remaining Unknowns. It should name who approved the route and when it must be reviewed again. Approval for one workflow is not blanket approval for new models, accounts, data classes or tools.

Close with a one-page decision record

Summarize the purchased surface, contracting parties, incorporated documents, approved workflow, data classes, model or endpoint, enabled features, subprocessors, retention and human-access rules, region, deletion test, incident contact, reviewer, accepted exceptions and next review date. Link each field to its evidence. A concise record gives users and operators an actionable boundary while the full diligence file remains available to the specialists who maintain it.

Reviewer boundary

This guide is an operational review map, not template language or a conclusion that a clause is sufficient in a jurisdiction. Counsel should review the executed agreement, applicable law, professional duties and client requirements.

FAQ

Is a vendor’s public DPA the contract that governs a law firm?

Not necessarily. The executed order form, incorporated terms, negotiated amendments and marketplace documents may change the result.

Does a no-training clause establish zero retention?

No. Training use, operational retention, safety logging, files, caches and downstream copies are separate fields.

Should a DPA name model subprocessors?

The review should identify every provider, platform and third-party feature that processes the relevant data and the document governing each relationship.

Sources checked

• Gemini API Additional Terms, checked 2026-09-03.
• Anthropic Commercial Terms, checked 2026-09-03.
• OpenAI Services Agreement, checked 2026-09-03.
• EU AI Act official text, checked 2026-09-03.

Operational information, not legal advice. Verify current terms, account configuration and applicable professional duties before use.