# OCR Vendor Data Processing Agreement: Clauses to Read

- Author: Schema Law (https://www.schemalaw.com/)
- Published: 2023-10-23T17:22:08Z
- Updated: 2026-10-11T19:22:20Z
- Category: Confidentiality
- Canonical: https://www.schemalaw.com/blog/ocr-vendor-data-processing-agreement

> What an OCR vendor data processing agreement should say about client documents: permitted use, subprocessors, output rights, deletion and what to negotiate.

An OCR vendor data processing agreement should say that the vendor handles your uploaded documents only on your instructions and only to perform the service, keeps them confidential, names any other companies involved, tells you promptly about a breach, and deletes or returns everything when you leave. If the terms are silent on any of these, ask.

An OCR tool may have no document with that title. The same subjects then sit in the terms of service and the privacy policy, and you read those instead. This post explains what to look for. It is not legal advice, and it does not tell you whether any particular agreement satisfies your professional duties, which depend on your jurisdiction and your client.

## What is a data processing agreement for an OCR service?

A data processing agreement for an OCR service is the contract that sets the rules for the documents you upload: what the vendor may do with them, who else may touch them, how they are protected, and what happens to them at the end. It sits beside the terms of service, which cover price and access.

The name comes from European data protection law. Under the [General Data Protection Regulation as published on EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj), a "processor" is a body "which processes personal data on behalf of the controller", and Article 28 requires that such processing "be governed by a contract" setting out "the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller." Whether that regulation applies to your firm depends on facts this post cannot assess. Its list is useful anyway as a checklist of what such a contract covers.

United States law has a cousin for health information. The HIPAA rule on [business associate contracts at 45 CFR 164.504](https://www.law.cornell.edu/cfr/text/45/164.504) lists terms such a contract must contain, including that the business associate will "Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware". Whether a law firm or its vendor is a business associate for a given set of records is a legal question for the firm.

### Why a lawyer reads it even when no statute requires one

The professional rules look at the arrangement, whatever it is called. [ABA Formal Opinion 477R](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-477.pdf) quotes Comment [3] to Model Rule 5.3, which lists among the factors bearing on a lawyer's reasonable efforts when using an outside provider "the terms of any arrangements concerning the protection of client information". The opinion's own list for vendor diligence includes "the use of confidentiality agreements". State versions of these rules differ, so read your own.

### The documents you may be handed

| Document | What it normally covers | Who it binds |
| --- | --- | --- |
| Terms of service | Access, fees, acceptable use, liability, licence to your content | Every customer |
| Data processing agreement or addendum | Instructions, confidentiality, security, subprocessors, breach notice, deletion | Customers who sign or accept it |
| Privacy policy | What the vendor does with personal information, often written for website visitors | A statement by the vendor |
| Subprocessor list | The other companies involved | Referred to by the agreement |
| Order form | Plan, term, any negotiated changes | You and the vendor |

Check which document wins if they conflict. A well-drafted agreement says so in an "order of precedence" clause. The privacy policy needs its own short read, and the post on client uploads shows a method for [reading a privacy policy in five minutes](https://www.schemalaw.com/blog/is-it-safe-to-upload-client-documents-to-an-ocr-tool#reading-a-privacy-policy-in-five-minutes).

## Which clauses decide what happens to uploaded client documents?

Seven clauses decide what happens to uploaded client documents: permitted use, confidentiality, security measures, subprocessors, breach notice, deletion and return, and audit or information rights. Read each one for a concrete duty. A clause that only says the vendor "takes privacy seriously" imposes nothing.

| Clause | What you want it to say | Wording that should slow you down |
| --- | --- | --- |
| Permitted use | Content is processed only to provide the service to you, on your instructions | "and to improve our products and services", "for research and development" |
| Confidentiality | The vendor and its staff keep content confidential, and staff are bound in writing | Confidentiality that covers only "information marked confidential" |
| Security measures | Stated measures, such as encryption and access limits, with a duty to maintain them | "commercially reasonable security" with nothing listed |
| Subprocessors | A named list, the same duties passed down, and notice before changes | "We may share data with affiliates and partners" |
| Breach notice | Notice to you within a stated time after the vendor becomes aware | "as required by applicable law" and nothing more |
| Deletion and return | Deletion on request and at termination, with a period for backups | "We may retain data as necessary for our business purposes" |
| Information and audit | The vendor will answer reasonable questions or supply reports | No route to ask anything |

### Permitted use is the clause that matters most

Everything else limits how the vendor carries out its work. The permitted-use clause defines the work. The regulation quoted earlier puts the standard form in a few words: the processor "processes the personal data only on documented instructions from the controller". For an OCR tool, your instruction is "convert this file and give me the output". A clause that also lets the vendor use content to improve its service, build data sets or develop new features goes beyond that instruction.

Watch for defined terms. Some agreements promise never to use "Customer Data" for training and then define a second category, such as "Usage Data" or "Derived Data", which the vendor may use freely. Read the definitions to see whether text taken from your documents could fall into the second category.

Personal data pulled into the text, including names and account numbers, has to fall inside the definitions you just read. Where the paperwork casts your client as the controller and your firm as the processor, the data processing agreement should track documented instructions for the conversion. Look for a breach notification sentence that states a number of hours, and copy that number into the vendor file.

### Confidentiality has to reach people

A company promises confidentiality through its staff and contractors. The standard clause, again in the regulation's words, requires that "persons authorised to process the personal data have committed themselves to confidentiality". Ask who at the vendor can open a customer file and whether that access is recorded.

### Law enforcement and legal demands

Terms may reserve the right to disclose content when the law compels it. Look for a promise to tell you first where the vendor lawfully can, so that the firm has a chance to assert privilege or seek protection.

Breach notice has many moving parts in practice, from what counts as "becoming aware" to what the firm does with the notice. The post on [what a law firm does after an OCR vendor data breach](https://www.schemalaw.com/blog/ocr-vendor-data-breach) follows that clause into use.

## Who owns the converted text and tables under the vendor's terms?

The terms decide it, in two clauses. One should say you keep whatever rights you had in the uploaded document and its converted output. The other gives the vendor a licence to handle both, and that is where the risk lies. The licence should cover only running the service for you, and should end when the content is deleted.

Ownership language is reassuring and almost beside the point. A sentence saying "You own your content" costs the vendor nothing. The working clause is the licence grant that follows, so read it slowly.

### Four parts of a licence grant

- **Scope.** "To provide the service to you" is narrow. "To provide, maintain, develop and improve our services" is wide.
- **Duration.** A licence that lasts while the content is in your account is narrow. "Perpetual" or "irrevocable" is wide.
- **Sublicensing.** The vendor may need to pass rights to its subprocessors. A general right to sublicense to anyone is wider than that need.
- **Survival.** Check the clause listing which terms survive termination. The licence should not be on it.

### Output and derived data

Converted text, tables and exports are sometimes defined separately as "Output". Make sure the confidentiality and deletion clauses apply to output as well as to uploads. A spreadsheet built from a client's bank statements is as sensitive as the statements.

Then look for anything the vendor creates from your content for itself: statistics, extracted fields, sample pages for quality checks, corrections you typed. If the agreement lets the vendor keep "aggregated or de-identified data", ask what that contains for a product whose raw material is page text.

### Feedback clauses

Terms may give the vendor broad rights in "feedback". That is harmless for a feature suggestion. It is less so if attaching a client's page to a support ticket counts as feedback. Ask, or simply do not attach client pages to tickets.

### An example to compare against

A narrow grant reads something like this:

> Customer grants Vendor a limited licence to host, copy and process Customer Content solely to provide the Service to Customer. This licence ends when the Content is deleted.

Hold the vendor's actual clause next to that and list the differences. Each difference is a question for the vendor.

## Subprocessor change notices and the right to object

A subprocessor change notice is the vendor's promise to tell you before it adds or replaces a company that handles your content. A right to object lets you refuse the change, usually by ending the contract. Without both, the list you approved on the day you signed can change the day after.

The regulation again supplies a model. Article 28(2) says a processor with general authorisation "shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes." Article 28(4) adds that the same data protection obligations "shall be imposed on that other processor", and that the first processor "shall remain fully liable" if the other one fails.

Translate that into five things to find in an OCR vendor's terms:

1. **How notice arrives.** An email to a named address is best. "We will update the list on our website" puts the burden on you to keep checking. If that is the mechanism, look for a subscription form and sign up with a shared mailbox, so notices outlive staff changes.
2. **How much warning.** A stated number of days before the new company starts handling content.
3. **What objecting gets you.** A veto over the change, or only the right to terminate the affected service and recover prepaid fees.
4. **Flow-down.** A statement that subprocessors are bound by terms no weaker than the vendor's own.
5. **Responsibility.** A statement that the vendor answers for its subprocessors' failures.

### What to do when a notice arrives

- Read what the new company will do. A new hosting region and a new company that reads page content are different events.
- Check client guidelines and court orders for matters with documents in the tool. Some require approval of anyone who handles the client's data.
- Decide within the objection window, and note the decision.
- If the firm objects, export what it needs, delete the rest and record the date.

How to work out who the current subprocessors are, and which of them reads the pages, is covered in the post on [OCR without sending documents to OpenAI](https://www.schemalaw.com/blog/ocr-without-sending-documents-to-openai).

## Deletion and return of documents when the subscription ends

When a subscription ends, the agreement should give you a period to export your documents and then require the vendor to delete what remains, including output, within a stated time, with backups following on a stated schedule. Cancellation alone deletes nothing unless the terms say it does.

The standard clause, in the regulation's wording, has the processor, "at the choice of the controller", delete or return all the personal data "after the end of the provision of services", and delete existing copies unless the law requires storage. The HIPAA provision cited earlier uses parallel language: "return or destroy all protected health information" at termination "if feasible".

### The end-of-contract timeline

| Stage | What to look for in the terms |
| --- | --- |
| Notice of cancellation | How to give it, and whether access continues to the end of the paid period |
| Export window | How many days you can still download, and in which formats |
| Deletion from live systems | A number of days after termination |
| Backup expiry | A further stated period |
| Confirmation | Whether the vendor will confirm deletion in writing on request |
| Exceptions | What the vendor may keep, such as billing records, and whether any content is included |

### Events people forget

- **Downgrades.** Moving to a cheaper plan may bring a shorter retention rule. Find out whether it applies to documents already stored.
- **Non-payment.** A lapsed card can suspend an account. Check whether suspension leads to deletion and how much warning you get.
- **The vendor's own exit.** If the vendor is sold or closes, the terms should say what happens to customer content. An assignment clause that lets the agreement pass to a buyer means your documents pass too.
- **Holds.** If a matter is under a preservation duty, export before you cancel.

How a firm sets its own periods while the subscription is live, and how it records deletion, is the subject of the post on [OCR with data retention control](https://www.schemalaw.com/blog/ocr-with-data-retention-control).

## Can a small firm negotiate an OCR vendor's standard terms?

Whether a small firm can negotiate an OCR vendor's standard terms depends on the vendor and the plan. Where a plan is sold on fixed terms, the firm's real choices are between vendors, between plans, and what it can get clarified in writing. Look for a plan that lists contract review, and put your questions in writing on any plan.

### What to try

- **Ask for the addendum.** A vendor may have a data processing agreement that applies only if you request or sign it. Asking costs nothing.
- **Get clarifications by email.** If a clause is ambiguous, ask what it means for uploaded documents and keep the reply. An email is weaker than an amendment and much better than an assumption.
- **Pick the plan that includes review.** If negotiated terms are offered only on one tier, price that tier before you rule the vendor out.
- **Bring a short list.** Three specific requests get further than a twenty-page markup. A fixed breach notice period, deletion confirmation on request, and advance notice of new subprocessors are reasonable asks.
- **Use the client's requirements.** "Our client's guidelines require X" is a concrete reason a vendor can take to its own lawyers.

### What to read even if it will not move

Liability caps, governing law and the vendor's right to change standard terms on notice are not about your documents directly, and a vendor may decline to change them. Know what they say, and factor them into which documents you send through the tool.

### A decision rule

Sort the seven clauses from earlier into must-haves and nice-to-haves for the documents you plan to upload. If a must-have is missing and the vendor will not add or clarify it, that tool is not for those documents. It may still be fine for public filings and blank forms.

### Schema Law as an example of the tiers

Schema Law's plan list shows how tiers can divide this. Six lines are stated for every plan, and four of them concern how documents are handled: "Your documents are never used to train an AI model", "Documents stay inside your own account", "Encrypted in transit and at rest" and "Delete any document, at any time". The Enterprise plan lists "Security questionnaire and contract review", and no other plan does. The site's [security commitments](https://www.schemalaw.com/#security) give the fuller wording, and the [pricing page](https://www.schemalaw.com/pricing) shows what each plan includes. The plan list does not describe a data processing agreement or its contents, so if your firm needs specific clauses, ask what is available on the plan you are considering. The questionnaire side of that process is described in the section on [security questionnaires and contract review](https://www.schemalaw.com/blog/enterprise-ocr-for-law-firms#security-questionnaires-and-contract-review).

Keep the version of the terms you accepted. Save a dated copy of each document on the day you sign up, because the web page will change and the copy you agreed to is the one that matters in a dispute.

## Try it on a real document

Upload a scanned PDF and export it as Word, a searchable PDF or plain text on the free plan. Your documents are never used to train an AI model. [Start free](https://www.schemalaw.com/api/auth/google)