Why a data processing agreement is not enough for law firms
A data processing agreement under Art. 28 GDPR satisfies data protection law, not professional conduct law. What law firms need on top of it.
A data processing agreement under Art. 28 GDPR satisfies data protection law, not professional conduct law. These are two separate regimes with separate addressees and separate consequences. A provider can serve one of them in full without touching the other at all.
Whom the processing agreement protects and whom confidentiality protects
The data processing agreement orders the relationship between controller and processor. It binds the service provider to instructions, commits it to technical and organisational measures, and governs deletion and return of the data as well as the engagement of further processors. What it protects is the data subject. Enforcement runs through the supervisory authorities.
The duty of lawyers’ confidentiality under § 43a BRAO (the German Federal Lawyers’ Act) has a different reference point. It protects the client relationship, that is, the trust that clients can tell their lawyer everything. The duty is addressed to the individual lawyer personally, and breaching it is a criminal offence under § 203 StGB (the German Criminal Code).
Different protective aim, different addressee, different sanction. A document built for one regime does not incidentally satisfy the other.
What § 43e BRAO requires on top
§ 43e BRAO is the provision that makes a service provider’s access to client secrets workable in the first place. It opens that route only on its own conditions, and they apply cumulatively: text form, an obligation of confidentiality combined with instruction on the criminal consequences, restriction of access to what is necessary, and passing the same conditions on to subcontractors. The details are in the checklist for the cloud contract.
None of these requirements follows from Art. 28 GDPR. That is clearest with the instruction: the processing agreement does not know it, because it lacks the criminal offence to instruct about. For tax advisory firms the parallel runs through § 62a StBerG. Anyone running both professions under one roof checks both provisions and not just one.
The question you should put to an AI provider
A different purchasing question follows from this. It is not “do you have a data processing agreement?” but: will you sign a confidentiality undertaking under § 43e BRAO, and how do you pass it on to your subcontractors?
Most providers answer the first question with a form, often self-service. The second often gets no answer at all, and that silence is itself information. A provider who cannot describe the chain of obligations downward, as a rule, does not have one.
With AI services this chain is rarely short. Depending on the setup, a software vendor, a model provider, a cloud operator and service providers for operations and support all sit between the firm and the data centre. Under professional conduct law none of these stations is an intermediate step the review may skip.
When data protection and professional conduct law diverge
A service can be cleanly set up in data protection terms and still not hold up under professional conduct law, because the chain of obligations is not carried through. This case is no special case. It is the normal case for offerings built for the general business market, because there Art. 28 GDPR is the highest hurdle regularly set.
GDPR-compliant AI in a law firm is therefore a necessary condition, not a sufficient one. Whether a particular contractual position holds up in an individual case depends on how it is drafted and cannot be answered in the abstract. The review does not disappear, it only moves.
The contract is only one half
Even a clean set of contracts is at first a promise. Restriction to what is necessary takes effect only once the access rights in the system reflect it, and the promise about the place of processing is more robust when it can be technically enforced rather than merely selected. Contract and configuration test the same requirement from two sides.
Inside the firm a third question stays open. The contract governs what the provider may do with the data. Which data reach the provider at all is governed by the internal AI usage policy.
In practice that means the provider review has two columns. The first holds everything data protection law demands, the second everything § 43e BRAO demands. Fill in only the first and you have answered the question the supervisory authority asks, and left open the one that ends in § 203 StGB.
The content of this blog was created partly with the support of AI.