How to Evaluate a Software Vendor's Data Processing Terms

Jun 12

12 min read

When a law firm adopts a cloud system for matters, documents, billing or client communication, it places client information in the hands of a third party. The firm remains answerable to its clients, to its regulator and, where personal data is involved, to the data protection authority for what happens to that information. The contractual instrument that allocates responsibility between the firm and the supplier is, in most cases, a data processing agreement. A careful review of the data processing agreement software suppliers offer is therefore one of the most important pieces of due diligence a firm can undertake before it migrates a single file.

The task is often done poorly. Suppliers present standard terms on a take-it-or-leave-it basis, the firm's principals are under pressure to start using the product, and the document is accepted by clicking a box. Yet the clauses on security, sub-processors, breach notification, location of data and the return of data at the end of the relationship determine whether the firm can meet its own obligations. A firm that cannot get its data back, cannot find out who has handled it, or learns of a breach from a newspaper has a problem that no feature of the software will solve.

This article explains how to approach the review. It identifies the roles of the parties, sets out the clauses that matter most and the questions to ask about each, offers a table of common weaknesses, and describes how a small firm with limited negotiating power can still obtain adequate protection. It refers to the UK GDPR as an example of a regime that prescribes the content of processor contracts, but it does not state the law of any jurisdiction in detail. Data protection and professional confidentiality rules differ, and practitioners must consult those of their own jurisdiction and regulator.

Roles: controller, processor and the firm's position

Data protection regimes commonly distinguish between a controller, which determines the purposes and means of processing personal data, and a processor, which processes personal data on the controller's behalf and on its documented instructions. When a firm uses a hosted practice management system to store client records, the firm is ordinarily the controller of that personal data and the supplier is a processor. This allocation has practical consequences.

The firm decides why and how client data is used. The supplier may use it only to provide the service and as the firm instructs.
The firm must satisfy itself that the supplier provides sufficient guarantees of appropriate security and compliance.
Where the regime applies, the arrangement must be governed by a written contract that contains specified terms.
The firm cannot delegate its accountability. If the supplier mishandles data, the firm may still be responsible to the affected individuals and the authority.

When the supplier claims to be a controller

Some suppliers reserve the right to use customer data for their own purposes, such as product analytics, benchmarking, advertising or the training of automated systems. To the extent that the supplier determines the purposes of that processing, it is acting as a controller or joint controller in its own right, and the firm would be disclosing client information to it for a purpose that the client has not authorised. For a law firm, this is a serious difficulty, since client information is subject to professional confidentiality in addition to data protection law. The firm should read every provision that grants the supplier a licence to use customer data and should confine it, so far as possible, to the provision of the service to the firm.

Professional confidentiality is wider than personal data

A data processing agreement is directed principally at personal data. A law firm's obligations are broader. Client files contain commercial secrets, privileged advice, litigation strategy and information about corporate clients, none of which is personal data in the legal sense. The duty of confidentiality attaches to all of it. A firm therefore should not assume that a standard data processing agreement is adequate simply because it addresses personal data. It should confirm that the supplier's contractual confidentiality obligations extend to all customer content, and that the supplier's staff who have access are bound by confidentiality and given access on a need-to-know basis.

The firm should also ask how the supplier handles legal process. If a third party, including a public authority, demands access to the firm's data, the supplier should be obliged, where lawful, to notify the firm promptly, to direct the requesting party to the firm, and to disclose only what it is legally compelled to disclose. This matters because privilege may attach to the material, and only the firm, or its client, can assert it.

The principal clauses in a data processing agreement for software

A thorough review proceeds clause by clause. The following sections describe the matters that a firm should check in any data processing agreement software supplier proposes.

Scope and instructions

The agreement should describe the subject matter and duration of the processing, its nature and purpose, the types of personal data and the categories of data subject. Descriptions that are excessively broad, such as any data the customer uploads for any purpose, are not necessarily objectionable, but the firm should check that they are accurate for its own use. The agreement should state that the supplier processes data only on the firm's documented instructions, and that it will notify the firm if it believes an instruction infringes data protection law.

Confidentiality and personnel

Staff with access should be subject to a duty of confidence. Ask how access is granted and recorded, whether support personnel can view customer content, and in what circumstances. A responsible supplier will limit such access to what is necessary for support and will log it.

Security measures

The agreement or a schedule should describe the technical and organisational measures that protect the data. Vague promises of industry-standard security have little value. The firm should look for specific commitments, such as encryption of data in transit and at rest, access controls, multi-factor authentication for administrative access, logging, segregation of customer data, vulnerability management, backup arrangements and a disaster recovery capability. The firm should also check whether the supplier may reduce the security measures during the term, and if so, whether a reduction below the baseline is prohibited.

Sub-processors

Suppliers rely on other providers for hosting, email delivery, support tooling and similar functions. Each is a sub-processor that may handle the firm's data. The agreement should identify the sub-processors or provide a list that can be consulted, require the supplier to impose equivalent obligations on them, and keep the supplier fully liable for their acts and omissions. It should also provide a notice period before a new sub-processor is engaged and a right for the firm to object, with a consequence if the objection cannot be resolved, ideally a right to terminate and obtain a refund of prepaid fees.

International transfers and location of data

Where data is stored or accessed from another country, the firm must consider whether the transfer is lawful under its own regime and what safeguards apply. Some regimes restrict transfers to countries without adequate protection unless an approved safeguard, such as standard contractual clauses, is used. The agreement should state where data will be hosted, from where support staff may access it, and whether the supplier may move it. The firm should also consider any professional rule or client instruction that requires data to remain within a specified territory. Particular clients, notably public bodies and regulated entities, may impose their own restrictions.

Assistance with data subject rights and regulatory obligations

Individuals may ask the firm to provide access to, correct or delete their data. The supplier should commit to assist the firm with such requests, and to assist with security, breach notification and impact assessments, within reasonable timeframes. A supplier who simply passes requests back to the firm, or charges excessive fees for assistance, can leave the firm unable to comply.

Personal data breach notification

This clause deserves close attention. The firm may have to notify the regulator, and perhaps affected individuals and clients, within a short statutory period after becoming aware of a breach. It can do so only if the supplier tells it promptly. The agreement should require notification without undue delay after the supplier becomes aware, and should state a specific outer limit in hours rather than days. It should require the supplier to provide the information the firm needs: the nature of the breach, the data and the individuals affected, the likely consequences and the measures taken. It should oblige the supplier to cooperate in investigation and remediation. A clause that merely allows the supplier to notify within a reasonable time, or only when a breach is confirmed to have affected the firm, is weak.

Audit and assurance

A small firm cannot realistically conduct on-site audits of a large supplier. It can, however, ask for assurance. The agreement should entitle the firm to receive information necessary to demonstrate compliance, which may include independent audit reports or summaries of security assessments. Where a supplier asserts that it holds a certification or has passed an audit, the firm should ask to see the supporting documentation and verify what the certification actually covers, since it may relate to only part of the supplier's operations. Marketing statements are not assurance.

Return and deletion of data

The exit clause determines whether the firm is locked in. At the end of the relationship, or on request, the supplier should return the firm's data in a commonly used, machine-readable format and then delete it, including from backups within a stated period, and certify that it has done so. The firm should check for the following.

Whether export is available during the term, without charge, so that the firm can test it.
Whether export includes documents, metadata, notes, time records, billing history and audit logs, or only some of them.
How long after termination the data remains available for retrieval, so that the firm has time to migrate.
Whether the supplier may retain data after termination for its own purposes, and if so, which data and why.
Whether the supplier may suspend access for a payment dispute, leaving the firm without its files.

Professional rules require a firm to retain files for a period after a matter closes, and limitation periods may require access to material long afterwards. A firm should therefore regard the ability to extract its complete records as a prerequisite and not a refinement.

Commercial terms that interact with data protection

The data processing agreement does not stand alone. It sits alongside the main subscription or terms of service, and the interaction between them can defeat protection that appears to exist on the face of the data processing document.

Limitation and exclusion of liability

Many suppliers cap their liability at the fees paid in a recent period and exclude certain losses altogether. A cap set at a modest subscription may bear no relation to the loss caused by a breach affecting client confidentiality. The firm should examine whether the cap applies to breaches of data protection or confidentiality obligations, whether a higher cap or a separate cap is available for such breaches, and whether the supplier carries insurance that covers cyber incidents. A small firm will rarely persuade a supplier to accept unlimited liability, but it may obtain a higher cap for data breaches, and even if it does not, it will understand the residual risk it is bearing.

Order of precedence

The agreement should state that, if there is a conflict between the data processing terms and the main terms, the data processing terms prevail in relation to personal data. Without this, a general clause permitting the supplier to use customer data for improving its services might override the narrow processing instructions.

Changes to terms

Online terms often permit the supplier to amend them unilaterally by posting a notice. The firm should seek a requirement for advance written notice of material changes and a right to terminate without penalty if a change is unacceptable. It should record the version of the terms accepted, and keep a copy.

Use of data for the supplier's own purposes

Look specifically for permissions to use customer data or content to improve products, to develop or train automated models, to produce benchmarks or to market. If aggregated or anonymised use is allowed, check the definition of anonymised and whether the process can genuinely prevent identification. Many firms will wish to prohibit any such use of content, particularly documents and communications.

Common weaknesses in data processing agreement software terms

Provision found	Concern	Suggested response
Supplier may use customer content to improve its services	Client confidences used for the supplier's own purposes	Restrict use to providing the service; prohibit use of content for model training or marketing
Breach notice within a reasonable time	Firm may miss its own statutory notification period	Fixed outer limit in hours after the supplier becomes aware
List of sub-processors available only on request	Firm cannot see who handles its data	Published list, advance notice of changes, right to object and terminate
Data location described as a region or left unstated	Possible unlawful transfer or breach of a client restriction	Named hosting location, with notice before any change
Liability capped at recent fees with no carve-out	Cap bears no relation to the loss from a breach	Higher or separate cap for data protection and confidentiality breaches
Export available only on request, at additional cost	Lock-in and difficulty in complying with retention duties	Self-service export during the term; defined format and period after termination
Supplier may suspend service for a payment dispute	Firm could lose access to client files	Notice and cure period, and continued access for retrieval of data
Unilateral amendment by posted notice	Protections may be diluted without agreement	Advance written notice for material changes; right to terminate
No commitment on legal process requests	Privileged material disclosed without the firm's knowledge	Duty to notify and redirect where lawful, and to disclose only what is compelled

Due diligence beyond the contract

A well-drafted agreement is only a promise. The firm should test whether the supplier is capable of keeping it. The following enquiries are proportionate for a small or medium-sized firm.

Ask for the security documentation. Request a description of the supplier's security programme, its incident response process and its most recent independent assessment summary, if any. A supplier who is unwilling to provide any description deserves caution.
Verify claims. If the supplier says it holds a certification or complies with a framework, ask for the certificate or report, check the scope and the date, and confirm that it covers the service the firm will use.
Review the incident history. Ask whether the supplier has experienced a security incident affecting customers, how it was handled and what changed afterwards. Look at public statements.
Check resilience. Ask about uptime commitments, backup frequency, recovery objectives and where backups are held. Verify whether service credits are the only remedy for extended outage.
Understand the supplier's own position. Consider the supplier's financial stability, ownership, how long it has operated and what happens to customer data if it is acquired or becomes insolvent. Ask whether there are provisions for continued access in that event.
Test the product. Verify administrative controls, such as role-based permissions, two-factor authentication, session management and activity logs, using a trial account with non-sensitive data.
Take references. Speak to another firm of similar size that has used the product for some time and ask about support, outages and export.

Negotiating when the firm is small

A solo or small firm cannot usually dictate terms to a supplier, but it can often achieve more than it expects, particularly if it approaches the exercise methodically.

Rank the issues. Identify three or four matters that the firm cannot accept, such as use of content for the supplier's own purposes, an unbounded breach notification period or an absence of export rights, and concentrate on them. Accept reasonable standard terms on the rest.
Ask in writing. A short list of specific questions and requested amendments, sent to the supplier's sales or legal contact, produces a clearer response than a general discussion. The answers become part of the due diligence record.
Use the supplier's own documents. Many suppliers publish a standard data processing addendum, a sub-processor list and a security overview. Compare the published documents with the draft the firm is asked to sign.
Request the signed version. Some suppliers incorporate a data processing addendum by reference. The firm should obtain a countersigned copy or at least a dated copy of the version in force.
Consider alternatives. If the supplier refuses to give assurances on essential points, the firm should treat the refusal as information and consider another product.

Where a matter involves a client with its own requirements, such as a bank or a public authority, the firm should check whether the client's outsourcing or vendor rules impose additional terms that must be passed on to the supplier.

Keeping the record: the firm's own documentation

The firm should keep a record of its assessment, because it may later have to show that it exercised reasonable care in selecting the supplier. A short file for each material supplier is sufficient. It should contain the following.

The signed or accepted agreement and data processing terms, with their date and version.
The completed due diligence questions and the supplier's answers.
Any security documentation or assurance reports received, with the date on which they were reviewed.
The list of sub-processors at the date of review, and notices of changes since.
The firm's assessment of residual risk and the decision, with the name of the principal who approved it.
The next review date. Data processing terms should be revisited at least annually and whenever the supplier announces a significant change.

The firm should also record the processing in its own register of processing activities where its regime requires one, and should update its privacy notice to clients if the use of a new supplier changes what clients are told.

Practical next steps

List every system in which the firm stores or processes client information, including email, document storage, billing, e-signature and the practice management system, and identify the supplier of each.
For each supplier, locate the data processing agreement or equivalent terms, and note any supplier that has none.
Review the high-risk clauses discussed above: use of content, sub-processors, location, breach notification, liability, and return and deletion.
Send a short written list of questions and requested amendments to any supplier whose terms are deficient on essential points.
Verify any certification or assurance claims against the underlying documents.
Test data export on a small sample before relying on the system, and record the result.
Create a supplier file for each material supplier and set a review date.
Check whether any client, regulator or professional body has issued guidance or imposed conditions on the use of cloud suppliers, and ensure that the arrangements comply.
Brief the firm's staff on which systems are approved for client information, and prohibit the use of unapproved tools.

How practice management software supports supplier governance

A firm that keeps its supplier files, engagement terms and client records within an organised system finds it easier to demonstrate to clients and regulators how information is handled. Legalytech provides cloud practice management software for law firms, and, as with any supplier, a firm should read its data processing terms, ask its due diligence questions and test its export functions before placing client files in it.

This article is provided for general information only and does not constitute legal advice. Practitioners should consult the rules of their own jurisdiction and regulator.