Data protection clause

What is a data protection clause?

A data protection clause sets out how the parties to a contract handle personal data: information about customers, employees, users or anyone else who can be identified. It says which laws apply, who decides what happens to the data, how it is kept secure, and what happens if something goes wrong. It is also called a data privacy clause or privacy clause.

Almost every commercial contract touches personal data in some way. A software vendor stores your customers’ records, an agency runs your email campaigns, a payroll provider handles salaries. The data protection clause is where the contract deals with that.

Example: a company hires a marketing agency to send its newsletter. The agency gets the company’s mailing list. The data protection clause says the agency may use the list only to send the newsletter, must keep it secure, must report a data breach quickly and must delete the list when the contract ends.

Data protection clause vs. data processing agreement (DPA)

The two are often confused, and many contracts need both.

A common setup: the main contract has a short data protection clause, and that clause says a DPA applies whenever one party processes personal data on the other’s behalf.

Controller and processor: who is who

Most data protection laws split the roles in two:

• The controller decides why and how personal data is used. Usually the customer: it owns the relationship with the people whose data it is.
• The processor handles the data on the controller’s behalf and only on its instructions. Usually the supplier: the software provider, the agency, the payroll service.

The clause should say which role each party has, because the obligations follow from it. Sometimes both parties are controllers for their own purposes, for example when two companies share customer data for a joint promotion. Then each is responsible for its own use, and the contract should say so.

What a data protection clause covers

1. Compliance with law. Each party complies with the data protection laws that apply to it.
2. Roles. Who is controller and who is processor, for which data.
3. Purpose. The processor uses the data only to perform the contract and only on documented instructions.
4. Security. Appropriate technical and organizational measures, such as encryption and access controls.
5. Confidentiality. Only staff who need the data get access, and they are bound to confidentiality. This is narrower than a general confidentiality clause, which covers business information of any kind.
6. Subprocessors. Whether the processor may use other providers, and how the customer is told.
7. Breach notification. How fast the processor reports a data breach, and what information it provides. See personal data breach.
8. International transfers. Whether data may leave the country or region, and on what basis.
9. Rights of individuals. Help with requests to access, correct or delete data.
10. Audits. Information and inspections to show compliance.
11. End of the contract. Return or deletion of the data.
12. Liability. Whether data protection breaches fall under the general liability cap or a separate one.

What the law requires

The clause has to meet the requirements of the laws that apply to the data. Two common examples:

• GDPR (EU). When a processor handles personal data for a controller, Article 28(3) requires a binding contract with specific terms, including processing only on documented instructions, confidentiality of staff, security measures, rules for subprocessors, help with breaches and requests, deletion or return at the end, and audits. Under Article 33, the processor must tell the controller about a personal data breach without undue delay, and the controller must usually notify the supervisory authority within 72 hours of becoming aware of it. That is why many contracts give the processor a short deadline, such as 24 or 48 hours.
• CCPA (California). A business that discloses personal information to a service provider needs a written contract that, among other things, prohibits the service provider from selling or sharing the information and from using it outside the business purposes specified in the contract. Without such a contract, the disclosure can count as a sale or sharing.

Other countries and US states have their own rules, so check which laws apply to the people whose data is involved, not only where the companies are based.

How to review a data protection clause

If you are the customer:

• Check whether a DPA is needed and that it is attached or referenced, not “to be agreed later”.
• Set a short breach notification deadline, so you can meet your own legal deadlines.
• Control subprocessors and transfers, with notice of changes and a right to object.
• Look at liability. A data breach can cost far more than the contract value; a general liability cap may not be enough.

If you are the supplier:

• Make sure your role is right. Accepting controller obligations for data you only process on instructions widens your exposure.
• Keep notification deadlines realistic, and make them run from when you become aware of the breach.
• Limit audits to reasonable notice, frequency and cost, and accept recognized certifications where possible.
• Align the clause with your standard DPA, so you do not end up with two sets of terms that contradict each other.

Data protection clause example

Finding the gaps in your supplier contracts

Many supplier contracts were signed before anyone asked about data protection, and some still have no DPA. In fynk, AI analysis reads each contract and extracts its key terms, so you can see which agreements contain a data protection clause and which still need a DPA. The DPA itself can be created from the free template and signed online with e-signatures, next to the main contract it belongs to.

Which contracts include a data protection clause?

Software and SaaS agreements, master service agreements, outsourcing and IT services contracts, marketing and agency agreements, payroll and HR services, employment contracts, and purchase agreements for companies that hold personal data. These free templates include one:

Related clauses

• Scope of processing The "Scope of Processing" clause outlines the specific activities and purposes for which personal data will be processed by one party on behalf of another, ensuring clarity and compliance with applicable data protection laws. It typically details the types of data involved, the processing methods to be used, and the duration of such processing activities.
• Subprocessing The subprocessing clause in a contract outlines the conditions under which a primary contractor may engage third parties to handle or process certain aspects of the contracted work. It typically includes obligations for obtaining consent from the primary client, ensuring subcontractor compliance with original contract terms, and maintaining data protection standards.
• Personal data breach A personal data breach clause sets out what happens when personal data is lost, stolen or exposed: how fast the party that discovers the breach reports it, what information it provides, and how it helps contain the breach and notify authorities and the people affected.
• Confidentiality clause A confidentiality clause is a provision in a contract that obligates one or both parties to keep certain information confidential and not to disclose it to third parties without prior consent. This clause is designed to protect sensitive information such as trade secrets, business strategies, and proprietary data shared during the course of the contractual relationship.
• Right to audit The "Right to Audit" clause grants a party the ability to review and examine the financial records, systems, and practices of another party to ensure compliance with contractual terms and accuracy of financial reporting. This clause is often included to provide transparency and accountability, and to safeguard against fraud or mismanagement.
• Return or destruction of confidential information The Return or Destruction of Confidential Information clause specifies the obligations of parties to either return or destroy all confidential information upon the termination or completion of the contractual relationship. This ensures that sensitive data is not retained unnecessarily, thereby protecting proprietary information and maintaining confidentiality.

Frequently asked questions

• What is a data protection clause in a contract?

  A section that sets out how the parties handle personal data: which laws apply, who is controller and who is processor, security, breach notification, transfers and what happens to the data when the contract ends.

• Is a data protection clause the same as a DPA?

  No. A data protection clause is a short section of the main contract. A data processing agreement is a detailed agreement that the GDPR requires when a processor handles personal data for a controller. Contracts often have a clause that refers to a DPA.

• Do I need a data protection clause if I am not in the EU?

  Often yes. The GDPR can apply to companies outside the EU that handle data of people in the EU, and many other countries and US states, such as California, have their own requirements for contracts with service providers.

• How quickly must a processor report a data breach?

  Under the GDPR, without undue delay after becoming aware of it. The controller usually has 72 hours to notify the authority, so contracts often set a shorter deadline for the processor, such as 24 or 48 hours.

• What is the difference between a data protection clause and a privacy policy?

  A privacy policy tells individuals how a company uses their data. A data protection clause is an agreement between two companies about how they handle personal data between them.