A company’s data—commercial, operational, and personal—is often among its most valuable assets. It may include, for example, customer and sales data, billing and payment information, employee and HR records, and operational or logistics data.
To manage this information, companies routinely engage third-party vendors or service providers to store, process, and analyze it on their behalf. Where that information includes personal data, the contract between those parties becomes an important tool for allocating risk and defining responsibilities.
Data protection is best approached as a shared obligation between a company and its vendors, shaped by the nature of the data, the services being performed, and the overall risk profile of the engagement.
In many companies, procurement teams play a central role in structuring these relationships. They are often on the front lines of balancing speed, cost, and operational needs with legal and compliance considerations—making it essential to understand which data protection terms matter most, how to allocate risk, and what is reasonable given the context.
Personal Data Protection as a Commercial and Legal Risk
Failing to adequately address personal data protection in a contract can have commercial and legal implications for both companies and their vendors and service providers.
For example, if a vendor mishandles a customer’s personal data, the customer may still be held responsible, potentially facing reputational harm, loss of customer trust, regulatory exposure, and possible significant fines and remediation costs. The customer may also be required to indemnify the individuals whose personal data is compromised.
These risks are not necessarily tied to deal size. Even low-value contracts can expose a company to outsized liability. For that reason, careful vendor selection, well-structured data protection terms, internal risk mitigation, operations business insurance and ongoing oversight are essential to any commercial agreement involving the processing of personal data.
Selecting a Data Vendor
Before entering into a commercial agreement with a data vendor, it is important to conduct sufficient due diligence to identify potential risk areas, including:
- Does the vendor have the technical capability to perform the desired services?
- What administrative, technical, and physical safeguards has the vendor put in place to protect the data and are they sufficient?
- Are the vendor’s data processing practices compliant with applicable privacy laws?
- Is the vendor financially stable and likely to remain so during the agreement term?
- What is the vendor’s reputation with customers and in the market?
Key Data Protection Clauses in Commercial Contracts
Once a vendor is approved, attention turns to the contract itself.¹ Certain provisions play an outsized role in protecting personal data, including:
- Role definition
Clearly define whether the company is acting as a “controller” and the vendor as a “processor,” or whether both are acting as independent or joint controllers. (Under some US laws, the terms “business” and “service provider” are equivalents.) - Scope of data
Specify the categories and types of personal data being processed and from whom (the “data subjects”). - Purpose of processing
Define the specific business purpose(s) for which the data is being processed. - Compliance with applicable laws
Identify relevant data protection laws and require express compliance. - Security measures
Describe the vendor’s required administrative, technical, and physical safeguards appropriate to the data, including testing and verification requirements. - Processing instructions
Specify the scope of the vendor’s data processing and limit it to the company’s documented instructions. - Sub-processors
Address whether and how the vendor may engage third parties, including notice and approval rights. - Breach notification and response
Define timelines, remediation responsibilities, and cooperation obligations in the event of a data breach. - Data location and transfers
Specify where the vendor will store and process the data, including any cross-border transfers. - Audit rights
Define audit rights and vendor’s reliance on third-party certifications (e.g., SOC 1 or SOC 2, etc.). - Use of anonymized data
Clarify whether the vendor may use aggregated or de-identified data, particularly after contract termination.
Internal Operational Considerations
While commercial agreements play an important role in allocating risk between a company and its vendors, they are only one part of an effective data protection strategy. Companies retain ultimate responsibility for how their data is collected, shared, and used—and should implement internal procedures that align with the nature of the data and the risks involved.
Key operational considerations include:
- Data minimization and classification
Limit the personal data shared with vendors to what is necessary for the service and classify data based on sensitivity to inform appropriate safeguards. - Vendor selection and risk assessment
Conduct risk-based due diligence before engaging vendors, taking into account the type of data involved, the vendor’s role, and the criticality of the services. - Internal access controls
Ensure that access to personal data within the organization is appropriately restricted to those persons who have a legitimate business need and are bound to an obligation of confidentiality and security. - Defined use and handling protocols
Establish clear internal guidelines for how personal data is transferred, accessed, disclosed and used internally and in connection with vendor services. - Incident response
Maintain internal processes for identifying, escalating, and responding to potential data breaches, including coordination with vendors where applicable. - Insurance and risk mitigation
Evaluate appropriate insurance coverage (both for the company and its vendors) and other risk mitigation strategies, recognizing that contractual protections alone may not fully address potential legal or commercial exposure, especially if there is a data breach. - Ongoing oversight and governance
Monitor vendor performance and compliance over time, including conducting periodic reviews (including possible audits or inspections of the vendor’s processing facilities) aligned with the level of risk.
Taking these steps will help ensure that data protection obligations are not placed solely on vendors but are managed as part of a company’s broader risk management approach. In practice, the most effective data management programs align contractual protections with a company’s internal operations—recognizing that both parties play a role in safeguarding data, but that the obligations placed on vendors should be reasonable, proportionate to the services being performed and reflective of the data.
Is a DPA Also Required?
The question of whether a Data Processing Agreement (DPA) is required depends on the applicable legal framework. US state privacy laws and the European Union’s General Data Protection Regulation (GDPR) take different approaches, though they require some similar contractual protections in practice.
US Approach
Under US state privacy laws, in particular the California Consumer Privacy Act (CCPA), a standalone DPA is not formally required when a service provider is engaged to process personal data. However, the CCPA does require the inclusion of specific contract provisions governing how the data is processed and protected.
In practice, these provisions are often addressed through a DPA or a dedicated data protection addendum, either incorporated into the main agreement or attached as a separate exhibit.
GDPR Approach
Under the EU’s GDPR, and its equivalent in the United Kingdom, a DPA is mandatory when a business (a “controller”) engages a third party (a “processor”) to process personal data subject to the GDPR.
The GDPR also requires that the DPA address specific obligations, although it does not prescribe exact contractual language. While this may leave some room for negotiation, these obligations cannot be waived or modified by either party.
Key processor obligations in a DPA include:
- Processing personal data only on documented instructions
- Maintaining confidentiality
- Implementing appropriate security measures
- Using sub-processors
- Assisting the controller with its compliance obligations
- Enabling the deletion or return of the personal data when the engagement ends
- Supporting audit and compliance requirements
The controller also has GDPR-mandated responsibilities, including ensuring it has a lawful basis to process and share the data, and that any necessary notices and consents have been obtained to collect and disclose the personal data.
Additionally, under the GDPR, if personal data will be transferred outside of the EU or UK to a processor located in a jurisdiction whose data protection laws are deemed “inadequate” (such as the United States), the DPA must include an approved transfer mechanism —most commonly the EU Standard Contractual Clauses (or the UK version).
Allocation of Liability and Risk
Potential harms and liability associated with data protection failures often exceed the value of the underlying contract itself, which is why allocation of risk and liability deserves explicit attention in vendor contracts.
Key considerations include:
- Will data breaches be subject to standard liability caps or higher “super caps”?
- Will there be liability carve-outs for breaches caused by the company’s non-compliance with applicable data protection laws or the DPA?
- What is the scope of indemnification for regulatory fines, third-party claims, and remediation costs?
Under the GDPR, individuals (the “data subjects”) who suffer harm as a result of a data breach have the right to receive full compensation from either the controller or processor (“joint and several liability”). Although a company and its vendor may contractually allocate liability between themselves, they cannot cap liability as to the affected individual.
DPAs typically do not include indemnification or liability provisions directly but instead reference the relevant provisions in the main commercial agreement. Thus, it’s important to review the indemnification and liability provisions in the agreement to confirm if they also reach the DPA.
Takeaway: Focus on What Matters
When negotiating data protection terms in vendor contracts, the goal is not to include every possible provision—but rather, to focus on the commercial and legal risks that matter most, while also recognizing market realities and the shared responsibility of both parties to identify and accept reasonable processing risks and take steps to mitigate that risk.
Vendors processing personal data are expected to maintain reasonable and appropriate protections in compliance with law; however, companies should not try to make vendors take on the role of an “insurer” for all data protection risks, which will most certainly create roadblocks.
For procurement teams in particular, this means aligning early with internal business, legal and compliance stakeholders to ensure that key issues are addressed before they slow down the deal or create unreasonable downstream exposure.
Key issues include:
- The nature and sensitivity of the data
- The volume of data involved
- How the data will be used by the company
- The purpose and scope of the vendor’s processing
A risk-based, pragmatic market approach leads to more practical, effective contracts—helping teams move efficiently while protecting entities on both sides of the transaction from avoidable exposure and unreasonable risks.
Mark Johnson is a Partner with OGC and brings over 20 years of experience in both private practice and in-house, including serving as in-house counsel and outside General Counsel for trade associations in the transportation and technology sectors.
1 On the question of whose template to use, many companies may prefer their own forms. However, vendor templates may better reflect the specifics of the services and include more developed data protection provisions.