.svg){kind=small}
Free AI DPA Generator
Draft a signable AI data processing addendum for a controller-to-processor relationship, using language aligned with GDPR Article 28 and written with the EU AI Act in mind. Answer a short guided form, choose your terms, then generate the addendum and download it as Word or PDF. It is free and needs no sign-up. Your details are processed securely to write the addendum and are never stored, sold, or used for training, so keep the form to contract-level details and leave secrets and PHI out.
Addendum details
Fill in the parties and the AI system, then choose your sub-processor and data-retention terms. You get a complete AI data processing addendum, with one clause for each GDPR Article 28(3) processor obligation, ready to download as Word or PDF.
Parties
Scope
Terms
Your addendum will appear here. Fill in the details on the left and select Generate addendum.
An AI data processing addendum (DPA) is the contract that sets out a processor's obligations when it handles personal data on a controller's behalf through an AI system. It records how the data may be used, kept secure, and deleted, and, for AI, that it is not used to train models without instructions. This free tool generates one from a short form, with a clause for each GDPR Article 28(3) obligation, as Word or PDF, with no paywall and no sign-up.
How the AI DPA generator works
01
Describe the parties and the AI
Enter the controller and processor, the effective date, the AI system covered, and the categories of personal data it processes.
02
Generate your addendum
The tool writes an addendum from your details, worded to align with GDPR Article 28, with one clause for each Article 28(3) processor obligation, tagged with its article number. Results come back in seconds.
03
Download and review
Export the addendum as a PDF or an editable Word file, then have it reviewed by legal counsel and your Data Protection Officer before you sign or rely on it.
Free, private, and built on GDPR Article 28
Most DPA templates sit behind a lead form or keep a copy of what you enter. This one asks for no sign-up and keeps nothing. Writing an addendum needs a language model, so your details are sent to our server and processed there, then discarded. The clauses are worded to line up with GDPR Article 28, which lists the terms a controller-to-processor contract must contain, and they are written with the EU AI Act in mind, for example, restricting the use of your data to train models without documented instructions. We built this from our own AI governance programme, not from a summary of the regulation: see BlockSurvey's AI Policy for how we apply the same processor obligations to ourselves.
01
Processed, never kept
Your details are processed securely to write the addendum and are never stored, sold, or used for training. Keep the form to contract-level details and leave secrets, personal data, and PHI out.
02
No account required
No sign-up and no email wall. A fair-use rate limit is the only thing standing between you and the tool.
03
Free, real download
The complete addendum as an editable Word file or PDF at no cost, not a watermarked sample.
What the addendum includes
One clause for each processor obligation in GDPR Article 28(3), tagged with its article number:
- Processing only on the controller's documented instructions, including an AI-specific term that the processor may not use your data to train models without instructions (Art. 28(3)(a)).
- Confidentiality commitments from everyone authorised to process the data (Art. 28(3)(b)).
- Security of processing under Article 32, including encryption and controls against leakage through prompts, logs, and model outputs (Art. 28(3)(c)).
- Sub-processor terms, general authorisation with prior notice, or none without written authorisation, plus flow-down obligations (Art. 28(3)(d)).
- Assistance with data-subject rights requests under Chapter III of the GDPR (Art. 28(3)(e)).
- Assistance with breach notification and data protection impact assessments under Articles 32 to 36 (Art. 28(3)(f)).
- Deletion or return of all personal data on termination, extended to sub-processor copies (Art. 28(3)(g)).
- Making information available and allowing audits and inspections (Art. 28(3)(h)).
- Parties, subject matter and scope, term and precedence, and signature blocks for both parties.
- A counsel-review legal notice added to the end of the document.
GDPR Article 28 vs the EU AI Act
They govern different things: GDPR Article 28 sets the contract terms between a controller and its processor, while the EU AI Act regulates the AI system itself. An AI DPA sits at the intersection, which is why this addendum follows Article 28 but adds AI-specific terms.
| GDPR Article 28 | EU AI Act | |
|---|---|---|
| What it governs | The contract between a controller and a processor handling personal data. | The AI system itself, by risk tier, and the duties of its providers and deployers. |
| What it produces here | The clauses in this addendum, instructions, security, sub-processors, deletion, audits. | AI-specific terms layered on top, such as no training on your data without instructions. |
| Who it binds | Any processor of personal data, AI or not. | Providers and deployers of AI systems in scope of the Act. |
| Related duty | Supports a GDPR Article 35 data protection impact assessment. | May require its own conformity and risk-management steps for higher-risk systems. |
Built for every team working with AI
Whether you are buying an AI tool or shipping one, the same processor obligations decide whether you can put personal data through it. This addendum gives you a dated starting point, and it pairs well with an AI survey platform when the data you feed those systems comes from people.
01
Compliance & privacy teams
Put an Article 28-aligned addendum in front of an AI vendor without starting from a blank page.
02
Legal & procurement
Redline a consistent baseline instead of every vendor's own one-sided template.
03
Product & engineering
Nail down the no-training-on-our-data term before you send data to a model.
04
Researchers & data teams
Document the data categories and retention terms reviewers expect to see.
05
Startups adopting AI
Answer a customer's DPA request without paying for a legal drafting tool.
06
AI vendors selling to enterprise
Offer buyers a clear addendum that already addresses training, sub-processors, and deletion.
Just wrote a no-training clause for your AI vendor?
The clause you generated, no use of your data to train models without instructions (Art. 28(3)(a)), only holds if the tools you collect that data with honour it too. BlockSurvey is an AI survey platform, encrypted end to end, with a published AI policy you can cite in your own vendor assessment, so responses are never sold, mined, or used to train models.
More free AI tools
Explore more →
These tools help you govern and document your AI use. When the data behind your AI comes from people, collect it with an AI survey platform built for privacy.
Frequently Asked Questions
- An AI data processing addendum (a DPA, sometimes called a data processing agreement or contract addendum) is the contract that sets out a processor's obligations when it handles personal data on a controller's behalf, here, specifically for an AI system or service. This free tool generates a signable addendum from a short guided form: it names the parties, describes the AI system and the data it processes, and writes one clause for each processor obligation in GDPR Article 28(3)(a) to (h), tagged with its article number. You download it as an editable Word file or a PDF.