Data Protection Contract Review
Every time your organisation shares personal data with a supplier, a partner, or another Controller or Processor, there should be a contract in place that meets the requirements of UK GDPR. In practice, many of those contracts are missing, incomplete, or contain terms that do not reflect the processing that is actually happening.
Procurement teams negotiate on price, service levels, and liability. What they do not always have the capacity to do is assess whether the data processing clauses are adequate, whether the allocation of controller and processor responsibility is correct, or whether the contract exposes the organisation to regulatory risk that no one has quantified.
Clark & Company reviews data processing agreements, controller-to-controller arrangements, and supplier contracts against UK GDPR requirements, and tells you plainly where the gaps sit and what needs to change.
Pricing
| Service | Published Price |
|---|---|
| Data protection contract review | £500 + VAT per contract |
What We Review
Clark & Company reviews the data protection provisions within the following contract types.
Data processing agreements. Article 28 processor agreements between your organisation and its suppliers. We assess whether the mandatory provisions are present, whether the terms reflect the processing that is actually taking place, and whether the controller’s rights of audit, instruction, and termination are properly protected.
Controller-to-Controller agreements. Data sharing agreements between your organisation and other controllers, including partner institutions, local authorities, funding bodies, and regulators. We assess whether the agreement properly defines each party’s obligations and whether it addresses the issues that arise when sharing goes wrong.
Supplier and procurement contracts. Broader supplier contracts where data processing clauses are embedded within commercial terms. We assess whether the data protection provisions are adequate in context and flag where the commercial and data protection positions are misaligned.
International transfer agreements. UK International Data Transfer Agreements, the Addendum to the EU Standard Contractual Clauses, and bespoke transfer arrangements. We assess whether the transfer mechanism is correctly applied, whether the transfer risk assessment supports it, and whether the documentation meets the ICO’s published expectations.
Sub-processor arrangements. Where your suppliers use sub-processors, we assess whether the contractual chain preserves your rights, whether the notification and objection mechanisms work, and whether the liability position is clear.
What is Included
Every contract review engagement with Clark & Company includes the following as standard.
Full clause-by-clause review. The data protection provisions are reviewed against UK GDPR requirements, ICO guidance, and practical enforceability. We do not skim for red flags. We read the contract properly.
Risk assessment. Where the contract creates regulatory risk, we quantify it in terms you can act on: what the exposure is, how likely it is to materialise, and what the consequence looks like.
Marked-up redline. You receive a redlined version of the contract with specific amendments proposed. The amendments are drafted in contract language, not summarised as recommendations for someone else to turn into clauses.
Plain language summary. A short written summary of what the contract says, where it falls short, and what you need to negotiate. This is the document you hand to your procurement team or your opposite number.
Negotiation support. Where the other party pushes back on your proposed amendments, Clark & Company is available to advise on the negotiation position: what to hold firm on, where to concede, and where the regulatory risk sits in each scenario.
Frequently Asked Questions
How long does a review take?
Most contract reviews are returned within five working days. Where a matter is urgent, faster turnaround is available on request. The scoping conversation confirms the timeline.
Can you review a contract that has already been signed?
Yes. Many organisations discover data protection gaps in existing contracts during audits, incidents, or supplier reviews. A review of a signed contract tells you where the exposure sits and informs the negotiation when the contract comes up for renewal.
Do you draft contracts from scratch?
This service covers review and amendment of existing contracts or supplier-issued terms. If you need a Data Processing Agreement or Data Sharing Agreement drafted from scratch, this is available as an ad hoc consultancy engagement.
Can you review multiple contracts at once?
Yes. Where you have a batch of supplier contracts to review, the per-contract price applies to each. For large-scale contract review programmes, a block arrangement can be scoped on enquiry.
Is this a legal review?
This is a data protection review, not a commercial legal review. We assess the data protection provisions against UK GDPR requirements and practical enforceability. We do not advise on limitation of liability, indemnity, or commercial terms. Where we identify issues that require legal advice, we will tell you.