SampleContractClauses
ByStephenM.Foxman,Esq.
Disclaimer:Thefollowingclausesareexamplesofactualdataprotectionclausesusedintechnology
agreements,adaptedtoremoveanyidentifyinginformationregardingtheprovidersorcustomers.Useand
finallanguageofthefollowingclausesmustbemodifiedtobeappropriateforanyspecificsoftwareorservice
beingprovidedbyalicensor,vendororserviceprovider.Suchclausesshouldnotbeusedwithoutadvicefrom
a
lawyerfamiliarwithtechnologyagreementsanddataprotectionissues.Closeattentionmustalsobepaidto
anydisclaimerorlimitationofliabilityclauses,whichmayunderminetheeffectivenessofremedies relatedto
anybreachbyanylicensor,vendororserviceproviderofitscontractualobligations.
ShortandConciseDataProtection
Clause:
DataProtection.LicensoracknowledgesthatitmayhaveaccesstocertainofLicensee’scomputerand
communicationssystemsandnetworksforthepur posessetforthinthisAgreement.Ifanydataismadeavailable
oraccessibletoLicensor,itsemployees,agentsorcontractors,pertainingtoLicensee’sbusinessorfinancial
affairs,orto
Licensee’sprojects,transactions,clientsorcustomers,Licensorwillnotstore,copy,analyze,monitor
orotherwiseusethatdataexceptforthepurposessetforthintheLicenseAgreementforthebenefitofLicensee.
Licensorwillcomplyfullywithall applicablelaws,regulations,andgovernmentordersrelatingtopersonally
identifiableinformation
(“PII”)anddataprivacywithrespecttoanysuchdatathatLicensorreceivesorhasaccess
toundertheLicenseAgreementorinconnectionwiththeperformanceofanyservicesforLicensee.Licensorwill
otherwiseprotectPIIandwillnotuse,disclose,ortransferacrossborderssuchPIIexceptasnecessary
toperform
undertheLicenseAgreementorasauthorizedbythedatasubjectorinaccordancewithapplicablelaw.Tothe
extentthatLicensorreceivesPIIrelatedtotheperformanceoftheLicenseAgreement,Licensorwillprotectthe
privacyandlegalrightsofLicensee’spersonnel,clients,customersandcontractors.
__________________________________________
ComprehensiveDataProtectionClauses(IncludingExhibitLanguage):
CustomerDataandIntellectualProperty.Allright,title,andinterestinCustomerData(asdefinedbelow )will
remainthepropertyofCustomer.Licensorhasnointellectualpropertyrights orotherclaimtoCustomerData
thatishosted,stored,ortransferredtoandfromtheProductsorthecloudservicesplatformprovided
by
Licensor,ortoCustomer’sConfidentialInformation.LicensorwillcooperatewithCustomertoprotectCustomer’s
intellectualpropertyrightsandCustomerData.LicensorwillpromptlynotifyCustomerifLicensorbecomesaware
ofanypotentialinfringementofthoserightsinaccordancewiththeprovisionsofthisAgreement.
SecurityandDataProtection.
1.
CustomerDataandSecurity.All CustomerDatathatwillbehostedbyLicensorunderthisAgreementwillbe
hostedatdatacentersmaintainedandoperatedby[insertname]locatedin[insertlocationaddressor
addresses](theDataCenters”).ForpurposesofthisAgreementandtheExhibitsattachedhereto
“Customer
Data”shallincludeanyCustomerConfidentialInformation,andanypersonallyidentifiableinformationrelatingto
anycustomers,endusersoremployeesofCustomer,itssuppliersorcontractors(“PersonalData”),towhich
LicensorhasormayhaveaccessinconnectionwiththeoperationoradministrationofLicensor’splatform,orin
connectionwith
theperformanceofProfessionalServicesbyLicensorforCustomerunderthisAgreementorany
applicableStatement(s)ofWork.AllCustomerDatastoredoratrestintheDataCenters,orintransport,willbe
encryptedintransportandwillnotbetransferredtoanyotherhostingentityorlocationwithout
thepriorwritten
consentofCustomer.
LicensorwillprovidethefollowingavailableservicesandfunctionsaspartoftheSoftwarewithoutadditionalcost:
(i)theuseofencryptiontechnology toprotectCustomerDatafromunauthorizedaccess;and(ii)routinebackup
andarchivingofCustomerData.Licensorwillcomplywiththe
requirementsofExhibit__(DataSecurity)and
implementtheDataSafeguardssetforthinthisSection,andLicensorwillfurtherimplementreasonablesecurity
standardsthatitdeterminesarenecessary,butinnoeventlessthanindustrystandards,toprotect(i)thephysical
securityoftheDataCentersusedtomaintain
CustomerData;and(ii)Licensor’snetwork,alloperatingsystems
andsoftwareapplications,andalldatastoragesystemsandmediaprovidedbyLicensororitslicensorsor
contractors,oroperatedorprovidedbyCustomerthatconnectorinterfacewithLicensor’sProducts,Softwareor
platform,frombeingsubjecttoanyDisablingDevices(as
definedinExhibit__(DataSecurity)attachedtothis
Agreement).
2.DataSafeguards.LicensorhasrepresentedtoCustomerthatLicensorwillnotbepermittedtoaccess
CustomerDatastoredorcontainedintheProductsorLicensor’splatform,andLicensorwillhavenoabilityto
manipulate,modifyorcontrolsuchCustomer
Data.IfanysupportservicesorProfessionalServicesprovidedby
LicensormayinvolveLicensororitspersonnelhavingorrequiringaccesstoCustomerservers,Customer
applications,and/orCustomerData,LicensorshallcomplywiththeprovisionsofthisSectionandExhibit__(Data
Security)attachedhereto,and,atCustomer’srequest,Licensor
shallenterintoanappropriateseparate
agreementwithCustomertogovernsuchaccessandprotectanyCustomerDatathatmaybesubject tosuch
access.TotheextentCustomergrantsLicensoraccesstoCustomerData,orLicensorhasaccesstoorstoresor
holdsanyCustomerData,Licensoragreesto:
(i)
accessandusetheCustomerDatasolelyforthepurposeofproviding Customerwithaccesstothe
Products,SoftwareandLicensor’splatform,andtoprovideProfessionalServicestoCustomerin
accordancewiththetermsandconditionsofthisAgreementandanyapplicableStatement(s)ofWork;
(ii)maintainphysical,technical,and
administrativesafeguards(includingbutnotlimitedtothoseset
forthinthisSection,Exhibit__(DataSecurity)attachedtothisAgreement,andinanyeventnolessthan
industrystandardsinthecloudcomputing/onlineservicesindustry)toprote cttheCustomer Dataagainst
unauthorizedaccess,use,ordisclosurewhileitisaccessible
toorheldbyLicensor(“DataSafeguards”);
and
(iii)notdisclosetheCustomerDatatoanythirdparty,except:(x)toitsemployees,consultantsor
contractorswhoneedtohaveaccesstosuchinformationandsolelyforpurposesofproviding
ProfessionalServicestoCustomer,providedthatsuchrecipients
areboundbyconfidentialityprovisions
nolessrestrictivethanthosesetoutinthisAgreement;and(y)totheextentrequiredbyajudicialorder
orotherlegalobligation,providedthat,tothefullestextentpermittedbylaw,Licensorwillpromptly
notifyCustomerofsucharequireddisclosuretoallowintervention
byCustomer(andwillcooperatewith
Customer)tocontestorminimizethescopeofthedisclosure.
3.SOC1/SSAE16Certification.Licensorwill,onatleastanannualbasis,hireathirdpartyauditingfirmto
performaStatementonStandardsforAttestationEngagements(SSAE)No.16audit,orequivalentaudit,on
internalandexternalLicensorproceduresandsystemsthataccessorcontainCustomerData.Licensor
shall
adheretoSOC1/SSAE16auditcompliancecriteriaanddatasecurityprocedures(oranysuccessorreportofa
similarnaturethatisgenerallyacceptedintheindustryandutilizedbyLicensor),applicabletoLicensor.
Licensor’ssecurityprocedureswillmateriallyconformtothedescriptionthereofsetforthinthis Agreement
and
inattachedExhibi t __(DataSecurity),andasfurtherdescribedinLicensor’smostrecentlycompletedSOC1/SSAE
16auditreport(oranysuccessorreportofasimilarnaturethatisgenerallyacceptedintheindustryandutilized
byLicensor).UponCustomer’srequest,LicensorwillprovideCustomerwithacopyof
theauditresultssetforthin
Licensor’sSOC1/SSAE16auditreport.
4.DataBreach.LicensorfurtheragreesthatitwillmonitorandtestitsDataSafeguardsfromtimetotime,and
furtheragreestoadjustitsDataSafeguardsfromtimetotimeinlightofrelevantcircumstancesorthe
resultsof
anyrelevanttestingormonitoring.IfLicensorsuspectsorbecomesawareofanyunauthorizedaccesstoany
CustomerDataorPersonalDatabyanyunauthorizedpersonorthirdparty,orbecomesawareofanyother
securitybreachrelatingtoPersonalDataheldorstoredbyLicensorunderthis
Agreementorinconnectionwith
theperformanceoftheProfessionalServicesorotherservicesperformedunderthisAgreementorany
Statement(s)ofWork(“DataBreach”),LicensorshallimmediatelynotifyCustomerinwritingandshallfully
cooperatewithCustomeratLicensor’sexpensetopreventorstopsuchDataBreach.Intheevent
ofsuchData
Breach,Licensorshallfullyandimmediatelycomplywithapplicablelaws,andshalltaketheappropriatestepsto
remedysuchDataBreach.Licensorwilldefend,indemnifyandholdCustomer,itsAffiliates,andtheirrespective
officers,directors,employeesandagents,harmlessfromandagainstanyandallclaims,suits,
causesofaction,
liability,loss,costsanddamages,includingreasonableattorneyfees,arisingoutoforrelatingtoanythirdparty
claimarisingfrombreachbyLicensorofitsobligationscontainedinthisSection,excepttotheextentresulting
fromtheactsoromissionsofCustomer.AllPersonalDatatowhich
LicensorhasaccessunderthisAgreement,as
betweenLicensorandCustomer,willremainthepropertyofCustomer.Customerherebyconsentstotheuse,
processingand/ordisclosureofPersonalDataonlyforthepurposesdescribedhereinandtotheextentsuchuse
orprocessingisnecessaryforLicensortocarryout
itsdutiesandresponsibilitiesunderthisAgreement,any
applicableStatement(s)ofWork,orasrequiredbylaw.LicensorwillnottransferPersonalDatatothirdparties
otherthanthroughitsunderlyingnetworkprovidertoperformitsobligationsunderthisAgreement.AllPersonal
DatadeliveredtoLicensorshallbestoredinthe
UnitedStatesorotherjurisdictionsapprovedbyCustomerin
writingandshallnotbetransferredtoanyothercountriesorjurisdictionswithouttheprio rwrittenconsentof
Customer.
DateSecurityExhibit:
EXHIBIT__
DataSecurity
NotwithstandinganythingtothecontrarycontainedintheMasterServicesandLicenseAgreementtowhichthis
Exhibitisattached(“Agreement”),andallotherExhibitsthereto,andinadditiontoandnotinlieuofother
provisionsintheAgreementandtheExhibitsthereto,Licensoragreesasfollows:
1.General
SecurityProcedures
1.1WithoutlimitingLicensor’sobligationofconfidentialityasfurtherdescribedintheAgreementandherein,
Licensorwillberesponsibleforestablishingandmaintaininganinformationsecurityprogramthatisdesignedto:
(i)ensurethesecurityandconfidentialityofCustomerData;(ii)protectagainstanyanticipatedthreatsorhazards
tothesecurityorintegrityoftheCustomerData;(iii)protectagainstunauthorizedaccesstooruseofthe
CustomerData;(iv)ensuretheproperdisposalofCustomerData,asfurtherdefinedherein;and(v)ensurethatall
subcontractorsofLicensor,ifany,complywithalloftheforegoing.Licensorwill
designateanindividualtobe
responsiblefortheinformationsecurityprogram.SuchindividualwillrespondtoCustomerinquiriesregarding
computersecurityandtoberesponsiblefornotifyingCustomerdesignatedcontact(s)ifabreachoranincident
occurs,asfurtherdescribedherein.Theinformationsecurityprogramwillbeauditedannua llyas
detailedin
Licensor’sSSAE16and/orSOC1auditreports,whichwillbemadeavailabletoCustomeruponrequest.
1.2 Licensormustconductformalsecurityawarenesstraining,withatestingcomponent,forallpersonneland
contractorsassoonasreasonablypracticableafterthetimeofhiringorpriortobeingappointed
toworkon
CustomerDataandannuallyrecertifiedthereafter.DocumentationofSecurityAwarenessTrainingmustbe
retainedbyLicensor,confirmingthatthistrainingandsubsequentannualrecertificationprocesshavebeen
completed,andavailableforreviewbyCustomer.
1.3 CustomerwillhavetherighttoreviewLicensor’sinformationsecurityprogramprior
tothe
commencementofCustomer’sentryofdataintotheProductsordeliverytoCustomerofanyProfessional
ServicesandfromtimetotimeduringtheTermofthisAgreement.DuringtheTermoftheAgreement, fr omtim e
totimewithpropernoticeandLicensorapproval,whichwillnotbeunreasonably
withheld,Customer,atitsown
expense,willbeentitledtoperform,ortohaveperformed,anonsiteauditofLicensor’sinformationsecurity
programandfacilities.Inlieuofanonsiteaudit,uponrequestbyCustomer,Licensorwillusereasonableefforts
tocomplete,withinfortyfive(45days)of
receipt,anInformationSecurityAssessmentquestionnaireprovidedby
CustomerregardingLicensor’sinformationsecurityprogram.
1.4 Intheeventofanyactualorapparenttheft,unauthorizeduseordisclosureofanyCustomerData,
Licensorwillimmediatelycommen ceallreasonableeffortstoinvestigateandcorrectthecausesandremediate
theresultsthereof,and
withintwo(2)businessdaysfollowingdiscoveryofanysuchevent,provideCustomer
noticethereof,andsuchfurtherinformationandassistanceasmaybereasonablyrequested.
1.5 CustomerData,includingbutnotlimitedtosalesdata,hosted,stored,orheldbyLicensorinthe
Product(s)orintheplatformoperated
byLicensor,oronanydeviceownedorinthecustodyofLicensor,its
employees,agentsorcontractors,willbeencrypted.LicensorwillnottransmitanyunencryptedCustomerData
overtheinternetorawirelessnetwork,andwillnotstoreanyCustomerDataonanymobilecomputingdevice,
suchasa
laptopcomputer,USBdriveorportabledatadevice,exceptwherethereisabusinessnecessityandthen
onlyifthemobilecomputingdeviceisprotectedbyindustrystandardencryptionsoftwareapprovedby
Customer.
1.6 ThepartiesacknowledgeandagreethatanydisclosureofCustomerDatawillinnowaybe
construedto
beanassignment,transfer,orconveyanceoftitletoorownershiprightsinsuchCustomerData.
2.NetworkandCommunicationsSecurity
2.1 AllLicensorconnectivitytoCustomercomputingsystemsandallattemptsatsamewillbeonlythrough
Customer’ssecuritygateways/firewallsandonlythroughCus tomerapprovedsecurityprocedures.
2.2
Licensorwillnotaccess,andwillnotpermitunauthorizedpersonsorentitiestoaccess,Customer
computingsystemsand/ornetworkswithoutCustomer’sexpresswrittenauthorization,andanysuchactualor
attemptedaccesswillbeconsistentwithanysuchauthorization.
2.3 LicensorwilltakeappropriatemeasurestoensurethatLicensor’ssystemsconnecting
toCustomer’s
systemsandanythingprovidedtoCustomerthroughsuchsystemsdonotcontainanyDisablingDevice.For
purposesofthisAgreement,“DisablingDevice”meansanyprograms,mechanisms,programmingdevices,
malwareorothercomputercode(i)designedtodisrupt,disable,harm,orotherwiseimpedeinanymannerthe
operationofanysoftwareprogramorcode,oranycomputersystemornetwork(commonlyreferredtoas
“malware”,“spyware”,“viruses”or
“worms”);(ii)thatwoulddisableorimpairtheoperationthereoforofany
software,computersystemornetworkinanywaybasedontheelapsingofaperiodoftimeortheadvancement
toaparticulardateorothernumeral(referredtoas“timebombs ”,“timelocks”,or“dropdead”
devices);(iii)is
designedtoorcouldreasonablybeusedtopermitapartyoranythirdpar tytoaccessanycomputersystemor
network(referredtoas“trojans”,“traps”,“accesscodes”or“trapdoor”devices);or(iv)isdesignedtoorcould
reasonablybeusedtopermitapartyor
anythirdpartytotrack,monitororotherwisereporttheoperationand
useofanysoftwareprogramoranycomputersystemornetworkbytheotherpartyoranyofitscustomers.
3. CustomerDataHandlingProcedures
ErasureofInformationandDestructionofElectronicStorageMedia.IfCustomerDatais
requiredtobe
permanentlydeletedfromanystoragemediaowned oroperatedbyLicensor,allelectronicstoragemedia
containingCustomerDatamustbewipedordegaussedforphysicaldestructionordisposal,inamannermeeting
forensicindustrystandardssuchastheNISTSP80088Guidelines forMediaSanitization.Licensormust
maintain
documentedevidenceofdataerasureanddestruction.Thisevidencemustbeavailableforreviewattherequest
ofCustomer.
4. PhysicalSecurity
AllbackupandarchivalmediacontainingCustomerDatamustbecontainedinsecure,environmentallycontrolled
storageareasowned,operated,orcontractedforbyLicensorandallbackupand
archivalmediacontaining
CustomerDatamustbeencrypted.
5.PenetrationTesting
LicensorwillprovideCustomerwithanannual,thirdpartyPenetrationTestreport.Duringthetermofthis
Agreement,Licensorwillengage,atitsownexpenseandatleastonetimeperyear,athirdpartyvendor
reasonablyacceptableto
Customertoperformpenetrationandvulnerabilitytesting (“PenetrationTests”)with
respecttoLicensor’ssystems.TheobjectiveofsuchPenetrationTestsistoidentifydesignand/orfunctionality
issuesininfrastructureofLicensor’ssystemsthatcouldexposeCustomerDataanditscomputerandnetwork
equipmentandsystemstorisksfrommaliciousactivities.
PenetrationTestswillprobe forweaknessesinnetwork
perimetersorotherinfrastructureelementsaswellasweaknessesinprocessortechnicalcountermeasures
relatingtoLicensor’ssystemsthatcouldbeexploitedbyamaliciousparty.PenetrationTestswillidentify,ata
minimum,thefollowingsecurityvulnerabilities:invalidatedorunsanitizedinput;broken
accesscontrol;broken
authenticationandsessionmanagement;crosssitescripting(XSS)flaws;bufferoverflows;injectionflaws;
impropererrorhandling;insecurestorage;denialofservice;insecureconfigurationmanagement;properuseof
SSL/TLS;properuseofencryption;andantivirusreliabilityandtesting.Withinareasonableperiodafterthe
annualPenetrationTesthas
beenperformed,CustomermayrequestfromLicensorareportofanyhighleveland
mediumlevelsecurityissuesthatwererevealedduringsuchPenetrationTestandsubsequentcertificationin
writingtoCustomerthatsuchhighlevelandmediumlevelsecurityissueshavebeenfullyremediated.Tothe
extentthathigh
leveland/ormediumlevelsecurityissueswererevealedduringaparticularPenetrationTest,
Licensorwillsubsequentlyengage,atitsownexpense, theTestingCustomertoperformanadditionalPenetration
Testwithinareasonableperiodthereaftertoensurecontinuedresolutionofidentified securityissuesandwill
notifyCustomerwiththeresultsthereof.

6.BackgroundChecks
LicensorwillperformbackgroundchecksonallLicensorpersonnelanddirecthirecontractorsincludingtemporary
andnonemployeepersonnelwhowillbeperformingservicesforCustomer,includingbutnotlimitedto
implementationservicesunderany Statement(s)ofWork,thatrequiresaccesstoCustomerDatapursuanttothis
Agreement.
LicensorwillnotassignanyemployeetoperformservicesforCustomerwhohasnotauthorizeda
backgroundinvestigation,orwhosebackgroundinvestigationhasrevealedtheconvictionofafelonyor
misdemeanorwithinthepreviousseven(7)years,measuredbackfromthetimesuchLicensoremployee
commencesservicespursuanttothe
Agreement,totheextentsuchfelonyormisdemeanorrelatestothe
suitabilityoftheindividual’semployment,excepttotheextentprohibitedbyapplicablelaw.IfLicensorcontracts,
foranyservices,withathirdpartythatneedstobeallowedorrequiresaccesstoCustomerData,thethirdparty
willundergothe
sameLicensorbackgroundchecksasperformedonLicensorpersonnelandcontractorsunderthis
section.
7. SSAE16/SOC1
CustomershallhavetherighttoterminatethisAgreement(togetherwithanyrelatedagreements,including
licensesand/orStatement(s)ofWork)andreceiveafullrefundforallmoniesprepaidthereunderinthe
event
thatLicensorfailstoproduceanacceptableSSAE16/SOC1TypeIIreport.
[EndofExhibitLanguage]
__________________________________________
InformationSecurityBreachNotificationClause.
[CloudProvider]agreestonotifyCustomerwithintwo(2)businessdaysinwritingofanydiscoveryby[Cloud
Provider]ofanybreachorsuspectedbreachoftheprovisionsofthisAgreementoranylossorunauthorizeduse,
disclosure,acquisitionoforaccesstoanyCustomerConfidentialInformationand/orCustomer’sbusinesssystems
ofwhich[CloudProvider]becomesaware(anysuchbreach orsuspectedbreachbeingreferredtohereinasa
“DataBreach”).SuchnoticeshallsummarizeinreasonabledetailtheeffectonCustomer,ifknown,oftheData
Breachandthecorrectiveactiontakenortobe takenby[CloudProvider].
[CloudProvider]shallpromptlytakeall
appropriateorlegallyrequiredcorrectiveactions,andshallcooperatefullywithCustomerinallreasonableand
lawfuleffortstoprevent,mitigateorrectifysuchDataBreach.Inadditiontothenoticerequirementcontained
herein,[CloudProvider]willalsoimmediatelyreportanysuchDataBreachto
Customer’sLegalDepartmentat
[inserttelephonenumberoraddress]
___________________________________________
InsuranceClauseforCyberliabilityInsurance.
[ServiceProvider]agreestopurchaseandmaintainthroughoutthetermofthisAgreementa
technology/professionalliabilityinsurancepolicy,includingcoveragefornetworksecurity/dataprotectionliability
insurance(alsocalled“cyberliability” )coveringliabilitiesforfinanciallossresultingorarisingfromacts,errors,or
omissions,inrenderingtechnology/professionalservicesorinconnectionwith
thespecificservicesdescribedin
thisAgreement:
Violationorinfringementofanyrightofprivacy,includingbreachofsecurityandbreachof
security/privacylaws,rulesorregulations globally, noworhereinafterconstitutedoramended;
Datatheft,damage,unauthorizeddisclosure,destruction,orcorruption,includingwithoutlimitation,
unauthorizedaccess,unauthorizeduse,identitytheft,theftofpersonallyidentifiable informationor
confidential
corporateinformationinwhateverform,transmissionofacomputervirusorothertype
ofmaliciouscode;andparticipationinadenialofserviceattackonthirdpartycomputersystems;
Lossordenialofservice;
Nocyberterrorismexclusion;
withaminimumlimitof$5,000,000eachandeveryclaimandin
theaggregate.Suchcoveragemustinclude
technology/professionalliabilityincludingbreachofcontract,privacyandsecurityliability,privacyregulatory
defenseandpaymentofcivilfines,paymentofcreditcardproviderpenalties,andbreachresponsecosts
(includingwithoutlimitation,notificationcosts,forensics,creditprotectionservices,callcenterservices,identity
theftprotectionservices,and
crisismanagement/publicrelationsservices).
Suchinsurancemustexplicitlyaddressalloftheforegoingwithoutlimitationifcausedbyanemployeeof[Service
Provider]oranindependentcontractorworkingonbehalfof[ServiceProvider]inperformingservicesunderthis
Agreement.Policymustprovidecoverageforwrongfulacts,claims,andlawsuitsanywhere
intheworld.Such
insurancemustincludeaffirmativecontractualliabilitycoverageforthedatabreachindemnityinthisAgreement
foralldamages,defensecosts,privacyregulatorycivilfinesandpenalties,andreasonableandnecessarydata
breachnotification,forensics,creditprotectionservices,publicrelations/crisismanagement,andotherdata
breachmitigationservicesresulting
fromabreachofconfidentialityorbreachofsecuritybyoronbehalfof
[ServiceProvider].
______________________________________
StephenM.Foxman
ECKERTSEAMANS
215.851.8422 [email protected]