Data protection agreements
We draft and review legally binding contracts to ensure secure and compliant data sharing under GDPR, UAE PDPL, and other global regulations. Our agreements protect your business while facilitating lawful data flows with vendors, partners, and third parties.
Key Types:
✔ Data Processing Agreements (DPAs)
✔ Data Transfer Agreements
✔ Joint Controller Agreements
Why data protection agreements matter
Whenever another organisation handles personal data on your behalf, or you share data with a partner, the law expects a written agreement that sets out who is responsible for what. Weak or missing agreements are a common finding in audits and customer security reviews, and they leave you exposed if a vendor has a breach.
Agreements we draft and review
- Data Processing Agreements (DPAs): between a controller and a processor, covering instructions, confidentiality, security, sub-processors, assistance with individual rights, breach notification, audits and deletion or return of data at the end of the contract. GDPR Article 28 sets out the minimum content for these.
- Data Transfer Agreements: for moving personal data across borders, including Standard Contractual Clauses and their UK equivalents, with supporting transfer impact assessments
- Joint controller arrangements: where two organisations decide together how and why data is used
- Data sharing agreements: between group companies, partners or other independent controllers
- Vendor privacy and security schedules: terms to attach to supplier contracts
Laws we draft for
UAE PDPL, DIFC DPL, ADGM DPR, KSA PDPL, GDPR and UK GDPR. Where a deal spans several of them, we build one agreement that works across them rather than leaving you with conflicting documents. Where a point needs formal legal advice, we work alongside your legal counsel. This page is general information, not legal advice.
What we look for when reviewing a vendor agreement
- Clear roles: who is the controller and who is the processor
- The data, purposes and duration of the processing are spelled out
- Security measures that are specific, not just “appropriate”
- Rules on sub-processors and onward transfers
- Breach notification timing that lets you meet your own legal deadlines
- Your right to audit, or to receive audit evidence
- What happens to the data when the contract ends
- Liability and indemnity that reflect the actual risk
How we work
- Inventory: we identify your vendors and data-sharing relationships.
- Prioritise: we rank them by the sensitivity and volume of data involved.
- Draft or review: we prepare templates or mark up the counterparty’s paper.
- Negotiation support: we help you explain and defend your positions.
- Maintain: we set up a register so renewals and changes do not slip.
Frequently asked questions
Do we need a DPA with every vendor?
You need one with every vendor that processes personal data on your behalf. Many vendors offer their own DPA, and we review it to see whether it meets your obligations.
What is the difference between a controller and a processor?
A controller decides why and how personal data is used. A processor handles it on the controller’s behalf and only on its instructions. The contract should reflect which role each party actually plays.
Do we need separate agreements for each country?
Often one well-drafted agreement can cover several jurisdictions, with schedules for country-specific terms. See our UAE and regional compliance service and EU and UK GDPR service.
Can you check our existing vendor contracts?
Yes. A vendor contract review is often part of a data protection audit or gap analysis.