Pactora Clause Guide
Data Protection
The data protection clause sets out how personal data is handled under the contract, who is the data controller, who is the data processor, and what obligations each party owes under UK GDPR and the Data Protection Act 2018.
This guide was written by Sneha Ganapavarapu, a qualified lawyer with experience in commercial contracts across technology, IP, and energy sectors. All legal sources are linked. This is general legal information, not legal advice. Always consult a qualified solicitor before signing any contract that matters to your business.
Plain English
What it is
The data protection clause sets out how personal data is handled under the contract, who is the data controller, who is the data processor, and what obligations each party owes under UK GDPR and the Data Protection Act 2018.
For UK freelancers & small businesses
What reasonable looks like
Clear identification of who is controller and who is processor.
Processor obligations set out — process only on documented instructions, implement appropriate security measures, assist with subject access requests, notify of breaches within 72 hours, delete or return data on termination.
Watch out for
Red flags
No data protection clause at all in a contract involving personal data.
Clause that makes you responsible as controller when you are clearly acting as processor.
No breach notification obligation.
No deletion or return of data on termination.
England & Wales
Market standard UK position
UK GDPR compliant processor terms.
Clear controller/processor distinction.
72-hour breach notification.
Data deletion or return on termination.
Legal advice triggers
Ask your lawyer if…
The contract involves personal data and has no data protection clause.
You are being made controller when you are acting as processor.
References
Legal sources
Read more
Further reading
Ready to check your contract?
Upload your contract to Pactora and we will flag data protection issues instantly — alongside all other key clauses.
Upload a contract to PactoraFurther reading
Related clause guides
Limitation of Liability
A limitation of liability clause caps how much one party can owe the other if something goes wrong.
Indemnities
An indemnity is a promise by one party to compensate the other for specific losses, costs, or claims — even if those losses weren't caused by a breach of contract.
IP Ownership
The intellectual property ownership clause determines who owns the work product created under the contract.
Termination
The termination clause sets out the conditions under which either party can end the contract, how much notice is required, and what happens when the contract ends.