Data Processing Agreements for Accounting Practices
An AI vendor sent its data processing agreement. What a DPA is, the clauses to check on training, subprocessors and deletion, and where it applies.
- Published
- Updated
A data processing agreement (DPA) sets the terms for how a vendor handles personal information on your practice’s behalf, including permitted uses and deletion.
An AI vendor’s agreement can permit more than answering your prompts. Read its training terms alongside the main service agreement before you upload client information.
What a Data Processing Agreement is
A DPA is a binding agreement that records the work a provider may do with personal information and its duties to your practice. It can be an attachment to the service agreement.
The familiar controller-and-processor contract comes from Article 28 of the General Data Protection Regulation (GDPR). The controller decides why personal data is processed. A processor handles that data on the controller’s behalf.
Under the GDPR, that relationship needs a binding contract. Ireland’s Data Protection Commission explains the required controller-processor contract terms, including the processing purpose and the people whose information is involved.
Australian vendors can use a DPA to document these responsibilities for customers, including those with GDPR obligations. Receiving one does not, by itself, establish that the GDPR applies to your practice.
For example, in a hypothetical arrangement, your practice sends an AI service a client document to summarise. The DPA limits how that service handles the document. A separate permission to use it for model training changes the arrangement.
Clauses to Check
Check what the agreement permits the vendor to do with each kind of client information. Read any documents incorporated by reference, including the security schedule and subprocessor list.
A subprocessor is another provider the vendor engages to handle personal information for the service. The contract needs to address that onward handling, as well as the vendor’s own work.
DPA Review Checklist
| Clause | What your practice needs to establish |
|---|---|
| Purpose and instructions | Name the service and permitted processing. Identify the information involved and the people it concerns. Check whether the vendor reserves independent uses. |
| AI training | Establish whether prompts, uploaded files or outputs can train or improve models. Identify any opt-out and whether it applies to your account and service. |
| Subprocessors | Identify the other providers and their jobs. Check approval or change-notice terms, your right to object and whether equivalent duties pass to them. |
| Storage and access | Identify storage countries, backup locations and countries from which staff can access information. Check the terms for changing those locations. |
| Confidentiality and security | Check who can access client information and the vendor’s commitments on encryption and staff confidentiality. Establish what evidence your practice can obtain. |
| Breach notice | Establish when the vendor must tell you about a suspected breach, who receives the notice and what investigation help it must provide. |
| Return and deletion | Check how you retrieve information before leaving. Identify deletion periods, backup treatment and any legal retention exceptions. |
| Enforceability | Read liability limits, dispute terms and the order of precedence if the DPA conflicts with the main agreement. |
These are review questions, not promises that every standard DPA contains the protection you need. Ask for a written amendment where the vendor’s answer differs from the contract.
The Office of the Australian Information Commissioner (OAIC) warns that commercial AI terms can permit further training. A confidentiality clause alone does not tell you whether the vendor can reuse client information.
For example, a no-training promise leaves retention unanswered. Establish whether the service keeps prompts for abuse monitoring, how long it retains them and who can read them.
When Australian Practices Need One
Australian practices need enforceable handling terms when their vendor arrangement requires them. The document’s title does not decide whether the arrangement meets Australian privacy or professional obligations.
For practices covered by the Australian Privacy Principles, APP 8 generally requires reasonable steps before overseas disclosure. The OAIC’s cross-border disclosure guidance generally expects an enforceable contract requiring overseas recipients to follow the APPs other than APP 1.
A DPA can document those obligations, including onward disclosure and breach response. Signing it alone does not establish compliance. The arrangement and the steps your practice takes to monitor it still matter.
The OAIC distinguishes overseas disclosure from limited storage arrangements where your practice retains effective control. Apply that distinction to the actual contract and access arrangements. Overseas hosting does not automatically settle the question.
The Tax Practitioners Board’s cloud computing guidance also directs attention to storage, changing terms and what happens when the arrangement ends. Code Item 6 requires client permission for third-party disclosure unless a legal duty applies.
Your contract with the vendor does not supply the client’s permission. Explain the proposed disclosure and obtain the required permission before disclosing information.
Keep the signed DPA with the service terms and linked schedules that apply to your account. Use an AI risk assessment for the broader vendor decision. Obtain legal review for unusual terms or uncertainty about your practice’s obligations.
One client form. One finished return.
Your client completes one guided form. Tax Genie checks it, chases mistakes and sends the details to your engagement letter and tax software.
Made for Australian accounting firms