Clause · Technology, Media & Telecommunications / IT Contracts
Data protection, security and breach-notification schedule (processor terms)
Schedule for contracts where a supplier handles a customer's personal information: purpose limits, security, sub-processors, offshore disclosure, incident notice supporting the NDB assessment, ransomware and SOCI reporting, audit and deletion; NZ and UK variants.
- Kind
- Clause. Wording to drop into a longer document.
- Where it applies
- Australia, New Zealand, United Kingdom (England and Wales)
- AI use
- Yellow AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at
- 17 October 2026
- Status
- Maintained. Checked against the cited sources on 17 October 2026.
- Version
- 1
- Source
- Written for this library
When to use it
Attach to a SaaS, outsourcing or development agreement where the supplier stores or processes personal information or other customer data. Adapt the incident timings to the customer's regulatory profile. For an EU or UK controller, use the UK GDPR art 28 mapping and add transfer terms.
How AI may be used
AI may map a vendor's security documentation and data processing terms against this schedule and mark gaps. A lawyer settles notification timing, offshore disclosure analysis and the allocation of breach costs.
AI may
- Extract stated data locations, sub-processors, certifications and retention periods from the vendor's documents into Annexure 1, marking anything unconfirmed.
- Compare the vendor's data processing addendum with this schedule and list gaps with clause references.
- Draft an incident notification template from clause 7.3 for the client's incident response plan.
AI must not
- Must not upload penetration test reports, architecture diagrams or SOC 2 reports to a tool that trains on inputs or is not approved for confidential material.
- Must not conclude whether a data breach is an eligible data breach; that is the customer's assessment.
- Must not change the regulatory notification timings without the lawyer checking the current law.
The lawyer checks
- Whether the customer is an APP entity, a reporting business entity for ransomware payments, or a responsible entity under the SOCI Act, and timings to match.
- The APP 8 position for each offshore location and sub-processor.
- That the schedule takes precedence over the main agreement and the vendor's online terms.
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Official form
Open the official form. Always use the current version from the issuer.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Technology, Media & Telecommunications / IT Contracts
- SaaS / cloud services agreement (Australian law, business customers)
- AI standard clauses for AI features in cloud services (Bonterms AI Standard Clauses v1.0, CC0)
- AI addendum: ownership of AI-generated output, training-data rights and AI-specific warranties (customer-side)
- Australian Government AI model clauses (DTA, BuyICT ClauseBank): use guide for agencies and suppliers
- Software development agreement with AI coding-assistant and open-source terms
- Checklist: reviewing a vendor SaaS or technology contract (customer side, including AI terms)
All precedents for Technology, Media & Telecommunications / IT Contracts · Tasks and AI use in this area