Data Protection Contracts - What Tends To Be Missing And What To Do About It

The General Data Protection Regulations (GDPR) has required organisations to adapt from relying on vague data protection clauses that were in many cases included by default in services agreements to the stringent requirements of Article 28 regarding controller-processor arrangements.

Organisations have also been using controller-to-controller and controller-to-processor Standard Contractual Clauses to legitimise most of their transfers of personal data to international organisations or third countries. Nowadays, long and detailed data protection contracts are commonplace. However, important inclusions are still left out of such contractions, leaving organisations vulnerable to regulatory action.