Whenever a supplier handles personal data for you, UK GDPR requires a written contract containing specific mandatory terms.
Payroll, IT support, cloud storage, CRM, marketing platforms, each one needs it. Most supplier contracts we review either have nothing or have something that falls short of the legal minimum, and the obligation to have the contract in place sits with you as the data controller, not with the supplier. It is also one of the first things a customer’s security questionnaire asks about.
A data processing agreement, or DPA, governs a supplier’s handling of personal data on your behalf.
We help with:
- reviewing the DPA a supplier has asked you to sign;
- drafting a DPA you can offer to every customer, if you are the supplier;
- processing terms inside a wider commercial contract;
- controller to controller and data sharing arrangements; and
- reviewing an existing supplier base to find the gaps.
We check the mandatory terms are actually there, that sub-processors are controlled rather than waved through, that audit and assistance obligations are workable, and that liability for a data incident is not quietly capped at a month’s fees.
We also settle the question underneath it all as to whether the relationship is really controller to processor, joint controllers or two independent controllers, because if the label is wrong the whole document is wrong.
Our Approach
Legal advice that makes running and growing your business easier.
We start with your business, not the law.
Before we open a document, we want to understand what you are trying to do commercially. The legal answer is only useful if it serves that.
We get to the point.
You get a clear view of what matters and what does not, in plain English, with the real risks separated from the noise.
We give you an answer.
Not a menu of options and a shrug. We tell you what we would do, why, and where there is a genuine judgment call for you to make.
We stay available.
Whether you work with us on a single project or on a subscription, we are here for the follow-up question. We would always rather you asked.
Ways of working together
Fixed-fee projects
A single, defined piece of work for an agreed fixed fee, communicated before we engage. Reviewing a contract, drafting your terms, handling a negotiation.
No surprises and no hidden fees
Flagship Subscription
Ares Access
Ongoing support on a fixed monthly subscription, for businesses that need commercial legal input regularly rather than as the occasional one-off.
- Dedicated lawyer
- Fixed monthly fees
- Commercial advice on demand
From £500 plus VAT per month
Data Protection Health Check
No surprises and no hidden fees
Any questions?
Phone: 02382 420035
