A Data Processing Agreement (DPA, German: AVV) is mandatory under Art. 28 GDPR whenever a vendor processes personal data on behalf of a customer. For an AI phone assistant this always applies — caller audio, transcripts and CRM data flow through the vendor pipeline.
A defensible DPA covers purpose, duration, type of data, categories of data subjects, technical and organisational measures (TOMs), and the rules around sub-processors. Vendors should provide a clearly versioned document, not a one-off PDF on request.
In practice, what also matters: a transparent list of sub-processors, guaranteed EU data residency, and a defined procedure for personal-data breaches. Without a DPA, deployment is formally unlawful even in B2B contexts.