GDPR questions to ask before uploading invoices to an OCR service

Supplier invoices routinely contain names, postal addresses, bank details and sometimes signatures. That makes them personal data, and sending them to a vendor makes that vendor a processor acting on your instructions. None of this is exotic; it simply means the questions below have to be asked before the first upload rather than after an incident.

This article is general information about what to ask, not legal advice. Where an obligation applies to your organisation specifically, take advice from someone qualified to give it.

The five questions

Ask these before your first upload, and get the answers in writing rather than from a sales call.

• Where are documents stored, and under which jurisdictions?
• How long are they retained after processing, and can I force deletion on demand?
• Are my documents used to train models? If so, can I opt out, and is opting out the default?
• Who inside the vendor can read my documents, and is that access logged?
• Is there a data processing agreement, and does it name the sub-processors?

What a good answer sounds like

A specific retention window rather than 'as long as necessary'. Deletion on demand that you can trigger yourself. No training on customer documents by default. Access that is limited by role and logged. A data processing agreement written to be read rather than to be survived. Vagueness on any one of these is itself an answer.

The question behind the questions

Every item above is really asking the same thing: does the document need to leave your control at all? Where recognition can run locally in the browser, the upload never happens and most of the list stops applying. That is not a universal answer — some workloads genuinely need a server — but it is worth establishing before you accept the risk by default.