Does AI Processing Count as Sharing Participant Data With a Third Party?

If an AI Service Processes the Data, Have You Shared Them With Someone Else?

You paste an interview transcript into an AI chatbot, upload a participant recording for transcription, or send a research dataset through an AI API. You have not emailed the file to another researcher or published it online. Have you nevertheless shared participant data with a third party?

In an ordinary sense, an external organization is now involved in processing the information. Legally, however, terms such as third party, data sharing, processor, service provider, business associate, and outsourcing have specific meanings that vary among jurisdictions.

This distinction matters because the provider's legal role can determine which contracts, disclosures, safeguards, approvals, and accountability requirements apply.

An External AI Provider Is Part of the Data-Processing Relationship

“Third Party” Does Not Mean the Same Thing in Every Privacy Framework

Technically Automated Processing Can Still Involve Another Organization

When you type participant information into software running entirely on an institution-controlled computer, no external provider necessarily receives the information. A cloud-based AI service is different.

Your prompt, file, image, recording, or other input may be transmitted to infrastructure operated by another organization and potentially its authorized subprocessors. That organization may process the information to provide the requested service even if no employee routinely reads your material.

The absence of a human reader therefore does not establish that no disclosure or external processing has occurred.

This distinction is particularly important when deciding whether participant data can be uploaded to an AI tool at all.

A Processor Is Not Necessarily an Independent Third Party

Many privacy frameworks distinguish an organization that determines why and how personal data are processed from another organization that processes information on its behalf.

Under the EU GDPR, for example, the European Data Protection Board explains that a controller determines the purposes and means of processing, while a processor processes personal data on behalf of the controller. The classification depends on the actual activities and decision-making roles rather than simply what the contract calls the parties.

The distinction is important because using a processor is not conceptually identical to disclosing data to an unrelated organization that independently decides how to use them.

The exact terminology differs among legal systems, so researchers should not assume that “processor” and “third party” are universally interchangeable terms.

The Philippines Explicitly Distinguishes Data Sharing From Outsourcing

The distinction is especially clear under the Philippine Data Privacy Act's Implementing Rules and Regulations.

The Rules define data sharing as disclosure or transfer of personal data to a third party, but expressly exclude outsourcing in which a personal information controller discloses or transfers personal data to a personal information processor. A personal information processor is an organization or person to whom the controller outsources or instructs the processing of personal data.

This means an external AI provider processing participant information solely on the institution's behalf could, depending on the actual arrangement, fall within an outsourcing relationship rather than “data sharing” in the specific legal sense used by the Philippine Rules.

That does not make the processing unregulated. Quite the opposite. The Rules require appropriate contractual safeguards for outsourced processing and keep the personal information controller accountable for personal data outsourced or transferred for processing.

Calling Something “Outsourcing” Does Not Remove Your Responsibilities

Under the Philippine Data Privacy Act, a personal information controller may subcontract processing, but remains responsible for ensuring appropriate safeguards. The implementing rules require outsourcing arrangements to be governed by a contract or other legal act covering matters such as the nature and purpose of processing, data categories, confidentiality, security, deletion or return of data, subprocessors, and geographic location of processing.

The Rules also state that a controller remains responsible for personal data under its control or custody when those data are outsourced or transferred for processing, domestically or internationally.

The practical implication for researchers is important: “the vendor handles security” is not an adequate governance model.

The Provider's Actual Use of Your Data Can Affect Its Role

Suppose an AI provider receives participant transcripts solely to generate summaries requested by the research institution and is contractually prohibited from using those transcripts for its own purposes. That arrangement looks different from one in which the provider may independently use submitted content to develop its products, train models, conduct unrelated analysis, or pursue other purposes.

The legal consequences depend on the governing framework and the exact arrangement. But as a practical matter, the more independently a provider determines what it will do with participant information, the less appropriate it becomes to describe the provider as merely acting on the researcher's instructions.

This is one reason researchers should examine the terms applicable to the exact product and account rather than relying on the provider's general reputation.

Consumer and Institutional AI Accounts May Create Different Relationships

The same provider may offer several products with materially different data terms.

An institutionally contracted enterprise service may include a data-processing agreement, defined retention controls, restrictions on model training, administrative controls, audit provisions, or other contractual protections. A personal consumer account may operate under different terms.

The interface can look almost identical while the governance relationship is substantially different.

Researchers should therefore verify the account type, applicable contract, data-processing terms, and institutional authorization rather than asking only, “Which AI company am I using?”

HIPAA Uses Yet Another Concept: the Business Associate

In U.S. settings governed by HIPAA, an external service provider that creates, receives, maintains, or transmits protected health information on behalf of a covered entity can be a business associate.

HHS specifically states that a cloud service provider performing such functions involving electronic protected health information can be a business associate even if the information is encrypted and the provider does not possess the encryption key.

When a cloud provider is a business associate, the covered entity or business associate generally needs a HIPAA-compliant business associate agreement with the provider and must otherwise comply with the HIPAA Rules.

This is relevant when clinical research data are processed through AI, but HIPAA terminology should not be generalized to studies outside HIPAA's scope.

Subprocessors Can Extend the Data-Processing Chain

The AI company whose name appears on the website may not be the only organization involved in delivering the service. Cloud infrastructure providers, content-delivery services, security providers, and other subcontractors may participate in processing.

Under processor-based data-protection frameworks, the use of subprocessors may be governed by contractual and authorization requirements. The Philippine implementing rules, for example, require processors not to engage another processor without prior instruction from the controller and require equivalent data-protection obligations to flow through the arrangement.

Researchers therefore need to understand the relevant processing chain rather than assuming that information stops at the company named on the login screen.

An API Does Not Make the External Processor Disappear

Researchers sometimes treat an API as if it were fundamentally more private because participants' data do not appear in a chatbot interface.

An API can provide materially different retention, training, and administrative controls, and those differences may make it more suitable for research. But if participant data are transmitted to an external provider through the API, external processing still occurs.

The technical interface does not determine the legal relationship. Contracts, data flows, purposes, provider practices, and applicable law do.

Local AI Can Change the Third-Party Question

If an AI model runs entirely on institution-controlled infrastructure and no participant data are transmitted to an external provider, the third-party processing issue may be substantially reduced.

That does not automatically make the use permissible. Consent, ethics approval, security, access controls, model behavior, and institutional policy may still matter.

But it illustrates why “using AI” and “sending data to an AI company” are not synonymous. Architecture matters.

The Ethics Question Can Be Broader Than the Legal Label

Even if applicable law classifies the arrangement as outsourcing rather than third-party data sharing, participants may reasonably care that their identifiable interview, image, clinical record, or recording is being processed outside the immediate research team.

This is why informed consent may need to address AI processing when external processing materially affects confidentiality or participant expectations.

The objective is not to force every technical arrangement into the colloquial phrase “third-party sharing.” It is to ensure that the legal classification does not obscure what is actually happening to participant data.

When the Same Upload Can Have Different Legal Characterizations

Common Mistakes About AI Providers and Third Parties

Map the Data Relationship Before You Upload Anything

Instead of beginning with the label “third party,” draw the actual data flow. Who sends the participant information? Which legal entity receives it? What is that entity allowed to do? Who else processes it? Where does processing occur? When is the information deleted?

Once those facts are clear, the correct legal classification becomes much easier to determine.

Once an external processing relationship has been identified, the next question is geographical as well as contractual: where the AI provider processes participant data may create additional requirements.

Before Treating an AI Provider as an Approved Data Processor

Questions About AI Providers and Third-Party Processing

Do Not Let the Word “Tool” Hide the Data Relationship

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.