CCS Example GDPR contract clauses

The EU General Data Protection Regulation (GDPR) comes into force on 25 May 2018 affecting all organisations processing personal data, and bringing new obligations on data controllers and data processors. General information about GDPR is available on the Information Commissioner’s website.

GDPR includes an important change that will affect commercial relationships between controllers and processors and these must be set out in contracts with specific terms included. These changes must be made to existing contracts involving personal data processing which will be in place beyond 25 May 2018, and new contracts let on or after 25 May 2018.

This document is a set of example contract terms and instructions on how to amend existing contracts provided by Crown Commercial Services.