---
title: "Map data locations and cross-border flows from a vendor data-processing agreement"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/map-data-locations-and-cross-border-flows-from-the-vendor-dpa/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A24-T1-R4-US"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Map data locations and cross-border flows from a vendor data-processing agreement

> List each processing location, subprocessor and transfer purpose named in the data-processing agreement. Do not label a transfer lawful or unlawful.

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/map-data-locations-and-cross-border-flows-from-the-vendor-dpa/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | List each processing location, subprocessor and transfer purpose named in the data-processing agreement. Do not label a transfer lawful or unlawful. |
| What the lawyer must review | There is no single federal adequacy regime. Rule 1.6 still forbids revealing client information, including by putting the agreement and its customer data into a public tool, unless informed consent, implied authority or a paragraph (b) exception applies. If the customer is a California business, compare the contract with Cal. Civ. Code § 1798.140(ag): a service provider must process under a written contract that prohibits selling or sharing, use beyond the stated business purposes, use outside the direct business relationship, and the combining the section describes. Formal Opinion 512 requires the lawyer to understand retention and training use before client data is entered into a tool. |
| Written for | United States |
| Applies to | [Map data locations and cross-border flows from the vendor DPA](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/map-data-locations-and-cross-border-flows-from-the-vendor-dpa.md) |

## Checking plan

- What the AI does: List each processing location, subprocessor and transfer purpose named in the data-processing agreement. Do not label a transfer lawful or unlawful.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- A European standard contractual clause in the paper does not answer a US state privacy question, and a US state statute does not answer a European transfer question.
- Sector statutes such as HIPAA were not applied here. Open them if the data are health or financial information.

## Sources

- [ABA Model Rule 1.6, Confidentiality of Information](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/) (checked 2026-10-22)
- [Cal. Civ. Code § 1798.140, including the service-provider definition](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140.) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [CCPA service provider and contractor addendum](https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/us-ccpa-service-provider-addendum.md) | Agreement | Yellow | Contract terms for a California service provider or contractor under Civil Code §§ 1798.100(d) and 1798.140. It limits purpose, bars sale and sharing, and sets notice and deletion help.… |
| [Cross-border disclosure assessment for a technology vendor (APP 8 and s 16C checklist and record)](https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/app-8-cross-border-disclosure-assessment.md) | Checklist | Yellow | A checklist and file record for deciding whether sending personal information to an overseas or offshore-hosted vendor is a use or a disclosure under APP 8, which exception (if any) applies, and the… |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*