May 31st, 2019

Legal Talk ​18: What Clauses Do I Need in My Data Contracts?

You pop over to my offices in the City. It is the first time that we have met here but things are now moving fast and getting very serious. 

The key question for today is if you pass your data to subcontractors for processing, then you need tough contracts with these subcontractors regarding how they handle and use your data. 

These subcontractors might be marketing agencies, web developers, partners, affiliates or anyone that you pass your data to and who uses it on your behalf. 

"So, what key clauses do I need in the contracts with these subcontractors?" You ask.
 
Well, you obviously need a written contract, but on the data side the key clauses that you should have in order to ensure compliance with data protection laws should cover the following areas: 

• The subcontractor will follow your instructions with regard to the processing of your data (including returning all of your data to you at the end of the contract).
• The subcontractor has the appropriate technical and organisational measures in place to keep the data safe and secure (including having staff with the relevant skills and experience to handle your data).
• The subcontractor will be under the same obligations that you are under in relation to data laws and the subcontractor will be responsible if it puts you in breach of data laws.
• The subcontractor will keep your data confidential.
• The subcontractor will not transfer your data to anyone else, save for them asking for your prior written consent to do so.
• The subcontractor will tell you straight away if anyone else has asked about your data.
• The subcontractor will tell you straight away if there is any loss, destruction or damage to your data.

 
"So, these are the key data clauses that I should have in my contract with people that are processing my data for me?" You ask.
 
Yes, that's it. Of course, you can expand on each clause and there are lots of templates out there on the internet that provide more legal wording, but the principles above should be captured in any contract that you have with someone that is processing your data.

“Can you provide me with this kind of template?” You ask.
 
Yes, I can. Although, as I say there are plenty of these templates on the internet. Again, if you send me any template that you can find, then I can update and customise it so it suits your needs.

It has taken about 30 minutes to get to this stage and you say this is enough information for now at least. If you want to get some weekend reading on this done however, I would start here: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/contracts/.

It is almost lunch time and you say you have a business meeting with some Angels who are interested in investing.
 
This is really exciting, please update me after the meeting. I hope it all goes well.

Best wishes,


Jimmy Desai
Your Legal Coach
​
P.S. Don't forget to subscribe and get even more exclusive content and legal insight. As always, this legal talk and all the legal talks are subject to our disclaimer, which you can find here.

​© 2019. Coaching Law Limited. All rights reserved.