GDPR Q26
Do I need to update my contracts for GDPR?
Q26. Do I need to update my contracts for GDPR?
Category: Contracts
GDPR-compliant contracts set expectations between controllers and processors. Updating agreements ensures everyone knows their responsibilities.
In simple terms
- Include mandatory Article 28 clauses for processor relationships.
- Cover data security, breach reporting, and deletion.
- Review contracts whenever processing changes.
Key clauses
Contracts must describe the subject matter, duration, nature, and purpose of processing, plus the types of personal data and categories of data subjects.
- Require processors to act only on written instructions.
- Mandate confidentiality for staff and subprocessors.
- Set conditions for engaging subprocessors, including approval procedures.
Operational safeguards
Include clauses on security measures, assistance with data subject rights, DPIAs, audits, and breach notification timelines.
- Specify how data will be returned or deleted when the contract ends.
- Allow audits or provide audit reports to demonstrate compliance.
- Address international transfers and required safeguards.
Practical steps to take
- Inventory all supplier and customer contracts involving personal data.
- Gap-analyse existing agreements against Article 28 requirements.
- Negotiate updates, prioritising high-risk processing first.
- Store signed agreements securely and track renewal dates.
- Revisit contracts whenever services, subprocessors, or laws change.
Real-life examples
SaaS provider agreement
A controller signs a data processing agreement with a SaaS vendor covering security certifications, breach notification within 48 hours, and deletion on termination.
Marketing agency contract
An agency agrees to use approved email tools, assist with SARs, and obtain consent before using subprocessors.
Helpful reminders
- Keep a contracts register so you know when reviews are due.
- Ensure liability and indemnity clauses reflect the risks involved.
- Provide processors with clear, updated instructions.
Key takeaway
Strong contracts make partnerships safer—set clear expectations and revisit them regularly.
Article references
Further reading
Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.