# GDPR questions to ask an AI presentation tool vendor

Nine questions to assess an AI presentation tool from a data protection point of view
before you upload client decks, documents or brand assets. For each question, write
down **the answer, a source link and the date**. A privacy statement without a date is
worthless: vendors change their terms, and nobody emails you about it.

"Not stated" is a valid result and often the most honest one. Don't fill the gap with
a guess.

Tool: ______________________  Reviewed by: ______________  Date: __________

---

## 1. Data processing agreement (DPA) available?

Without a DPA, you shouldn't hand the vendor any personal data, and client names,
figures and org charts end up in slides faster than you think.
Where to look: usually under "DPA", "Legal" or in the trust center; often only on a
paid plan.

- [ ] yes  - [ ] no  - [ ] not stated
- Source: ______________________________________  Date: __________

## 2. Server location disclosed?

The location decides whether your data leaves the EU/EEA at all and which extra
safeguards you need. That includes where the AI generation runs, not just where decks
are stored. Check whether it's selectable or only promised.

- [ ] yes  - [ ] no  - [ ] not stated
- Location: ____________  Source: ______________________  Date: __________

## 3. Sub-processors listed publicly?

Every sub-processor is another company with access, often including the AI model
provider that receives your prompts and slide content. A public, dated list with
change notifications is the mark of a good vendor.

- [ ] yes  - [ ] no  - [ ] not stated
- Source: ______________________________________  Date: __________

## 4. Customer data excluded from training (or opt-out available)?

Whatever goes into training doesn't come back. For uploaded decks, client documents
and unreleased numbers, this is the critical point. Note the difference between
"off by default" and "you can opt out".

- [ ] off by default  - [ ] opt-out available  - [ ] no  - [ ] not stated
- Source: ______________________________________  Date: __________

## 5. EU representative appointed (Art. 27 GDPR)?

A vendor without an establishment in the EU needs a representative; otherwise data
subjects have no one to contact. Usually near the bottom of the privacy policy.

- [ ] yes  - [ ] no  - [ ] not required (established in the EU)
- Source: ______________________________________  Date: __________

## 6. Standard Contractual Clauses (SCCs) for transfers outside the EU?

The usual route when data is processed outside the EU/EEA without an adequacy
decision, together with a transfer impact assessment. Check which modules are
included.

- [ ] yes  - [ ] no  - [ ] not required
- Source: ______________________________________  Date: __________

## 7. Deletion periods documented?

A deletion promise without a time frame isn't a promise. This also applies to backups,
logs and generated versions of your decks.

- [ ] yes, period: __________  - [ ] no  - [ ] not stated
- Source: ______________________________________  Date: __________

## 8. Independent certification (ISO 27001, SOC 2)?

Doesn't replace your own review, but shortens it. A report without a scope says
little: check the scope, the date, and that it's issued to the vendor, not just its
cloud host.

- [ ] yes: ____________________  - [ ] no  - [ ] not stated
- Source: ______________________________________  Date: __________

## 9. What happens to uploaded files and brand assets?

Presentation tools collect more than prompts: source documents, existing PPTX files,
logos, fonts, brand templates and images. Ask whether they are used for training,
shared across workspaces, kept after you delete a deck, or reused as "inspiration" for
other customers. Check the terms (license you grant on uploaded content), the DPA
(deletion) and the help center (brand kits, template sharing). If it isn't written
down, ask in writing.

- [ ] used for training  - [ ] kept after deletion  - [ ] shared beyond our workspace
- [ ] none of these (documented)  - [ ] not stated
- Source: ______________________________________  Date: __________

---

## Result

- Open points: ______________________________________________
- Decision: [ ] approved  [ ] approved with conditions  [ ] rejected
- Review again on: __________ (recommended: after 180 days)

---

This checklist comes from aipptxmaker.com and may be freely used, adapted and shared
within your company. It is **not legal advice** and **not a data protection impact
assessment (DPIA)**. Whether a particular use is allowed depends on your data and
your purpose.

https://aipptxmaker.com/checklists/gdpr-questions/