GDPR (Data Processor)

A company that handles personal data for a customer acts only within written instructions. Security, confidentiality and support during an incident are the promises it signs. For AI traffic, the starter covers the technical side of those promises.

A processor does not choose the purpose. The work is to prove that instructions were followed and that nothing moved without permission. Read the chain below as the measures section of an agreement, expressed as configuration.

The stages match the controller starter, because the same baseline ships with both. What changes is the question you answer with it. Your customer asks for evidence of access control, redaction and confidentiality, and each stage produces a line of that evidence.

A consent header must accompany every inbound request, without exception. The personal, sensitive and biometric categories in the setting are recorded with the decision, not used to pick which calls get checked. National identifier numbers and bank account numbers are masked. Prompts that reach for genetic, biometric or health data are refused, which supports the confidentiality duty you signed.

Every call your customer sends ends with a recorded escalation and no generated content. That gives you a clean handover point rather than a silent answer, and it also means the assistant answers nobody without help. Transfer questions, automated decisions and forwarded rights requests are the work your reviewers should expect. Quality floors of 0.80 apply to combined score, relevance and accuracy.

Subprocessor approval, audit cooperation and breach notice timing are contract obligations that no policy chain satisfies. Keep your subprocessor list current, and keep your customer informed. The closing stage marks an evaluated request and holds nothing back.