Clarify the roles first
Controllers determine the purposes and means of processing. Processors act within documented instructions. Whether these roles apply to a service depends on the actual arrangement, not just the agreement's heading.
Article 28 GDPR sets requirements for processing on behalf of a controller. These include subject matter and duration, nature and purpose, data categories, confidentiality, safeguards and support for data-subject rights.
Include the model route
Application hosting, storage, document recognition and external model calls may involve different providers. The current subprocessor list and change process provide transparency. Region, remote access and deletion after termination also inform the assessment.
For AI Link, the agreed service scope is considered alongside the actual approved provider structure. The agreement should match the chosen configuration.
Collect the review materials
A useful review connects the agreement with technical and organisational measures, a data inventory and a specific workflow diagram. Record open questions and their owners before processing production data.
Sources & further reading
Original research, provider documentation and further reading on the concepts and figures discussed here.