What Is a Data Processing Agreement (DPA) for AI Training Data?

Footage of people is personal data. When a vendor handles it for you, GDPR expects a written contract fixing what the vendor may do with it. Legal and procurement teams often ask for the DPA before a pilot, so a dataset can stall at contract review even when the data fits the task. Knowing what a DPA covers shortens that review.

The site publishes a data processing addendum at /dpa. It is marked as a draft, placeholder language not yet reviewed by counsel, and the signed agreement controls. It states that roles are confirmed in the order form, that personal data is processed only to collect, de-identify, quality-check and deliver the datasets, and that a sub-processor list is available on request.

A data processing agreement is a written contract between a controller, the party that decides why and how personal data is processed, and a processor, the party that processes it on the controller’s behalf. GDPR Article 4 defines both roles. Article 28(3) says processing by a processor shall be governed by a contract or other legal act that is binding on the processor with regard to the controller.

That contract sets out the subject-matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects, and the controller’s obligations and rights. Legal teams usually mean this document when they say DPA. This page is general information, not legal advice; your counsel decides what applies to your use.

A DPA matters when a vendor handles personal data for you. First-person footage often shows people other than the wearer, plus faces, license plates and voices, so who is controller and who is processor is a real question, not a formality.

The answer differs by deal. The /dpa page says the order form confirms whether Firsthand acts as an independent controller or as your processor for participant footage collected to your specification. Settle that first, because every later obligation follows from it. Your counsel decides the answer for your jurisdiction.

They answer different questions, and the first table compares them. A DPA governs how personal data is handled. A training-data license governs what you may do with the dataset. Consent records show that participants agreed before capture. A privacy policy tells people what the vendor does with their data.

None is a substitute for another. A signed license does not settle processing terms, and a consent release does not say what a processor may do with footage after capture. The site’s procurement guide lists the same set of contract documents: an order form or master agreement, a spec, a DPA and a license.

Article 28(3) lists what the contract shall stipulate in particular. The processor acts only on documented instructions, people authorised to process the data are bound by confidentiality, and the security measures required by Article 32 are taken. Other processors are engaged only on the stated conditions, the processor helps with data-subject requests and compliance duties, and at the controller’s choice it deletes or returns the data when services end. It also makes available the information needed to show compliance and allows audits. Article 28(4) extends the same obligations to any further processor.

The second table sets those topics against what /dpa states. Where /dpa is silent, the table says not stated. For a dataset, also ask how de-identification is documented, since that decides what personal data remains in delivered files.

Beyond /dpa, the site states that contributors sign a written commercial release before capture. It states that faces and license plates are blurred, audio is scrubbed, and clips that cannot be reliably de-identified are discarded. Participants may request withdrawal in line with the release terms, and the data card lists consent artefact IDs per episode and jurisdictions of capture. A guide on the site also says an anonymization record ships with a data-processing summary suitable for a DPIA.

The /dpa page says a SOC 2 Type II audit is in progress, so no completed certification is stated. Specific sub-processor names, data residency, audit rights, breach notification terms, deletion or return terms and retention periods are not stated. The signed agreement controls over any summary on the site.

Raise the DPA and the roles at spec stage, not at delivery. Where coverage is deep, a first validated batch lands in a median of 48 hours from signed spec; thinner environments typically take three to four weeks. Contract review that starts after the first batch can end up setting your schedule, so ask legal to read /dpa, /provenance and the license terms while the skill spec is written.

What is a data processing agreement?

The contract that governs how a processor handles personal data on a controller’s behalf. GDPR Article 28(3) requires one where a processor processes personal data for a controller. This is not legal advice.

Is a DPA the same as a training-data license?

No. A DPA covers how personal data is handled. A license covers what you may do with the dataset and derived models. Firsthand states a perpetual, irrevocable, worldwide, non-exclusive-by-default license, and the signed order form controls.

Does AI training data need a DPA?

It can, when footage shows identifiable people and a vendor processes it as your processor. The roles differ by deal, so ask your counsel. On this site, the order form confirms whether Firsthand acts as an independent controller or as your processor.

Who signs a DPA?

The controller and the processor. For Firsthand engagements, the /dpa page says its terms attach to a commercial agreement and the roles are confirmed in the order form.

Is the Firsthand DPA final?

The /dpa page is marked as a draft, placeholder language not yet reviewed by counsel. The signed agreement controls over anything on the website.

Does Firsthand state a security certification?

The /dpa page says a SOC 2 Type II audit is in progress and the report will be available under NDA once complete. No completed certification is stated.

What does Firsthand not state about data processing?

Specific sub-processor names, data residency, audit rights, breach notification terms, deletion or return terms and retention periods are not stated. The /dpa page says a sub-processor list is available on request.

What should a buyer check in a DPA?

Roles, purpose and scope, documented instructions, security measures, sub-processors, international transfers, deletion or return, and audit rights. Compare them with the license and the consent records.