Glossary
Definition
A DPA is a contract between a data controller and a data processor that sets out how personal data will be processed, protected, and deleted under GDPR.
Under GDPR and similar laws, an organization that decides why and how personal data is processed (the controller) must have a written agreement with any vendor that processes it on their behalf (the processor). The DPA covers the subject matter and duration of processing, the types of data, security measures, subprocessor approval, breach notification, assistance with data subject requests, audit rights, and deletion at termination.
For AI vendors, buyers should look for explicit terms on training: whether customer data may be used to train models, and whether model providers acting as subprocessors are bound by the same restriction.
Meridian's standard DPA includes the EU Standard Contractual Clauses where required and a contractual commitment that customer data is not used to train Meridian's or any third party's models.
Read next
Long-form explainers and frameworks that use this term, dated and signed.
Governance
A seven-part framework for governing AI agents in HR: scope statements, least-privilege data permissions, approval tiers, audit trail, model choice, employee communication, and works council and GDPR alignment.
Marcus Feld7 min read
Buying and ROI
A 12-question vendor checklist, the red flags that predict failed deployments, a five-step pilot design, seven success metrics, and a 14-week timeline from first call to scale decision.
Nadia Kowalski6 min read
Get started
Start with one workflow, one approver, and one number to move. Most design partners were live in five weeks.