When an AI platform processes your client contracts or claims files, GDPR applies - and it assigns clear roles and obligations. This is a plain-language overview of the parts that matter most when you bring document intelligence into a regulated practice.
Controller and processor
Under GDPR, the organisation that decides why and how personal data is processed is the controller. A vendor that processes that data on the controller's instructions is the processor. When you use a document-AI platform on your own files, you are typically the controller and the platform is your processor. That relationship has to be governed by a written agreement.
The Data Processing Agreement
A Data Processing Agreement (DPA) is the contract that sets out how the processor may handle your data. A serious DPA addresses, at minimum:
- The scope and purpose of processing, and that it follows your instructions.
- Confidentiality and the security measures applied to the data.
- Where the data is stored and whether it ever leaves that location.
- Use of any sub-processors, and your right to be informed.
- Breach notification timelines.
- What happens to your data on deletion or end of contract.
What "data residency" actually means
Data residency is simply where your data physically lives and is processed. "EU data residency" should mean the data stays on infrastructure located in the EU - not that a company is European while the servers sit elsewhere. It is a property you should be able to point to concretely. InVerba holds data in AWS eu-central-1 (Frankfurt), within the EU.
The rights you must be able to honour
GDPR gives individuals rights - access, rectification, erasure, and others. As controller, you must be able to act on them, which means your processor has to support them: the ability to find, export, and delete the relevant data within the required timeframes, with a record that it was done.
This article is a general overview, not legal advice. For obligations specific to your organisation, consult a qualified data-protection professional.