--- title: "DPA Overview | Enterprise Speech Data | YPAI" url: https://ypai.ai/speech-data/dpa/ description: "Data Processing Agreement overview for enterprise speech data collection. GDPR Article 28 aligned, sub-processors disclosed, audit documentation available." source: "src/copy/routes (route /speech-data/dpa/)" --- # Executed before the first recording. The DPA, and what it puts on paper. > Data Processing Agreement overview for enterprise speech data collection. GDPR Article 28 aligned, sub-processors disclosed, audit documentation available. Roles, processing scope, consent and provenance, sub-processors, retention and audit access, fixed in the agreement before production collection begins. Draft terms come to your legal team during scoping. ### Data Processing Agreement - **Basis**: GDPR Article 28 - **Processor**: Your Personal AI AS, Lysaker - **Controller**: the client, or YPAI as independent controller where agreed - **Jurisdiction**: Norwegian, EEA processing ## Who is the controller is decided per engagement, and written down. The role follows from the nature of the processing and the contractual requirements. - **Processor engagements**: YPAI processes personal data on behalf of the client organisation according to documented instructions. The client remains the Controller. - **Independent controller engagements**: In certain arrangements, YPAI acts as an Independent Controller for specific processing activities. This is documented in the engagement agreement. Role definitions, responsibilities and obligations are specified in the DPA and reviewed during scoping. ## What is processed, and for which purposes. five categories, each with its purpose Speech data collection workflows involve processing of audio recordings and associated metadata. The DPA Annex lists the categories and the purposes each one serves. - Anonymised identifiers, demographic categories as defined per project Data is processed for the purposes of collection, validation, quality assurance, and delivery as defined in the engagement agreement. ## Every recording carries its consent. The audit trail is the platform's own record. Data collection runs on the YPAI platform, so the consent and provenance of each recording can be traced. - **Consent**: Obtained from the contributor before recording begins. Records are kept and can be produced for your compliance review. - **Recording**: Captured on the platform, under the specified conditions, against the consent record. - **Provenance**: Each recording is associated with contributor identifier, timestamp and consent reference. - **Audit trail**: Provenance records, consent documentation and processing logs. Provenance stays traceable in long-term production use. Audit trail requirements and access procedures are defined contractually. ## Who else touches the data is in the agreement, with the change procedure. Sub-processors engaged in data processing activities are disclosed as part of the DPA terms. - **Disclosed**: Sub-processor list or categories provided during scoping. - **Governed**: Sub-processor governance procedures defined in the DPA. - **Notified**: Update notification and approval mechanisms agreed contractually. ## How long the data lives, and what happens when the engagement ends. Retention periods and deletion procedures are defined contractually during scoping. - **During the engagement**: Retention windows vary by engagement and are specified in the DPA. Your own retention policy can be written in, per project. - **Deletion**: Deletion procedures aligned with GDPR requirements, with timelines provided for your review during scoping. - **After the engagement**: Return or deletion, as documented in the DPA. Post-engagement handling is written into the agreement before signature. ## Access is limited and documented. The documentation is yours to review. Internal controls and security measures are implemented to protect data during collection, processing, and delivery. - **Access control**: Access to data is limited to authorised personnel. Access control policies are documented and available for review. - **Audit documentation**: Available for your legal and compliance review. Documentation of security practices is provided on request during scoping. ## Signing, roles and sub-processors ### When is the DPA signed? The DPA is executed before production collection begins. During scoping, YPAI provides draft DPA terms for your legal review. The signed agreement is finalised before any data processing starts. ### Is YPAI a Controller or Processor? Role designation depends on the engagement model. YPAI may act as Data Processor or Independent Controller depending on the contractual arrangement. Role definitions are specified in the DPA and reviewed during scoping. ### Can we review sub-processors before signing? Sub-processors are disclosed as part of the DPA terms. A list of sub-processors or categories of sub-processors is provided during scoping for your review. ### How is consent demonstrated? Consent is obtained on the YPAI platform and recorded per recording. Provenance records are kept for audit purposes. Details of consent mechanisms are documented in the DPA and available for compliance review. ### What audit artefacts can you provide? Provenance records, consent documentation and processing logs, for your legal and compliance review. Specific audit requirements can be addressed during scoping. ### What happens if requirements change after pilot? Requirement changes are handled through contract amendment procedures defined in the engagement agreement. YPAI works with your legal and procurement teams to document changes appropriately. ### How are deletion requests handled? Deletion and retention terms are defined contractually during scoping. Procedures for handling deletion requests are documented in the DPA and aligned with GDPR requirements. ### Do you support regulated environments? Yes. Healthcare, finance and automotive engagements are scoped with the sector's own regulatory requirements, in technical and compliance scoping. ### Can we use our own DPA template? Yes. YPAI reviews and works with client-provided DPA templates. Template review and negotiation occur during the scoping phase. ### How are sub-processor changes communicated? Sub-processor update procedures are defined in the DPA. Notification mechanisms and approval workflows are agreed upon during contract negotiation. Bring the requirement. The draft DPA comes back with the scoping brief. A formal appendix for your legal review is part of scoping. Your own DPA template is reviewed in the same step. - [Speech data overview](https://ypai.ai/speech-data/) - [Technical specifications](https://ypai.ai/speech-data/technical-specifications/) - [Data residency and sub-processors](https://ypai.ai/speech-data/data-residency/) - How YPAI processes customer and project data