Does this checklist replace legal advice?

No. It organizes the questions that come up in every purchase. Whether a particular use is allowed depends on your data and your purpose.

Can I use this list at my company?

Yes, freely: use it, adapt it, share it. A credit is appreciated but not required.

What if a vendor doesn't answer a question?

That is an answer in itself. Write down "not stated" with the date instead of filling the gap. That's what we do, too.

GDPR questions to ask an AI presentation tool vendor

9 questions. The first eight are the ones we ask in every review and publish on every verified listing with a source link and date; the last one matters especially when you upload decks, documents and brand assets. Take them with you, along with why each one matters and where the answer is usually found.

Download as Markdown

✓	Question	Why it matters	Where to find the answer
1	Data processing agreement (DPA) available	Without a data processing agreement, you shouldn't hand the vendor any personal data, and client names, figures and org charts end up in slides faster than you think.	Usually under "DPA", "Legal" or in the trust center. Often only available on a paid plan.
2	Server location disclosed	The location decides whether your data leaves the EU/EEA at all and which extra safeguards you need. That includes where the AI generation runs, not just where decks are stored.	In the trust center or the technical docs. It's rarely selectable; check whether it's a promise or an actual setting.
3	Sub-processors listed publicly	Every sub-processor is another company with access, often including the AI model provider that receives your prompts and slide content. You need to know them in order to object.	A public, dated list with change notifications is the mark of a good vendor. Without one, you have nothing to go on.
4	Training on customer data: default and opt-out, by plan	Whatever goes into training doesn't come back. For uploaded decks, client documents and unreleased numbers, this is the critical point.	In the terms of service and often in the account or workspace settings. Note the difference between "off by default" and "you can opt out".
5	EU representative appointed (Art. 27 GDPR)	A vendor without an establishment in the EU needs a representative under Art. 27 GDPR; otherwise data subjects have no one to contact.	In the privacy policy, usually near the bottom, with a name and address.
6	Standard Contractual Clauses (SCCs) for transfers outside the EU	When data is processed outside the EU/EEA without an adequacy decision, Standard Contractual Clauses are the usual route, together with a transfer impact assessment.	As an annex to the DPA. Check which modules are included.
7	Deletion periods documented	A deletion promise without a time frame isn't a promise. This also applies to backups, logs and generated versions of your decks.	In the DPA or the documentation; look for "retention".
8	Independent certification (ISO 27001, SOC 2)	A certificate doesn't replace your own review, but it shortens it: someone independent has looked.	ISO 27001 or SOC 2 Type II, with scope and date. A report without a scope says little, and check that it's issued to the vendor, not just its cloud host.
9	What happens to uploaded files and brand assets?	Presentation tools collect more than prompts: source documents, existing PPTX files, logos, fonts, brand templates and images. Ask whether they are used for training, shared across workspaces, kept after you delete a deck, or reused as "inspiration" for other customers.	Rarely in one place. Check the terms (license you grant on uploaded content), the DPA (deletion) and the help center (brand kits, template sharing). If it isn't written down, ask in writing.

How to record the answers

For each question, write down three things: the answer, the link where it's stated, and the date. A privacy statement without a date is worthless: vendors change their terms, and nobody emails you about it. That's exactly why every answer we publish carries a review date, and every review comes due again after 180 days.

"Not stated" is a valid result and often the most honest one. Don't fill the gap with a guess.

This checklist is not legal advice and not a data protection impact assessment (DPIA). It organizes the questions; it doesn't answer them for your situation. Details in our disclaimer.