---
title: "Data protection, security and breach-notification schedule (processor terms)"
url: "https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/data-protection-and-security-schedule"
type: "precedent"
site: "AI Law Framework"
id: "a24-data-protection-and-security-schedule"
area_id: "A24"
kind: "clause"
ai_level: "yellow"
version: 1
law_stated_as_at: "2026-10-17"
---

# Data protection, security and breach-notification schedule (processor terms)

> Schedule for contracts where a supplier handles a customer's personal information: purpose limits, security, sub-processors, offshore disclosure, incident notice supporting the NDB assessment, ransomware and SOCI…

Canonical page: https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/data-protection-and-security-schedule  
Law stated as at: 2026-10-17

Site index for agents: https://ailawframework.com/llms.txt

Schedule for contracts where a supplier handles a customer's personal information: purpose limits, security, sub-processors, offshore disclosure, incident notice supporting the NDB assessment, ransomware and SOCI reporting, audit and deletion; NZ and UK variants.

## Key facts

- Kind: Clause. Wording to drop into a longer document.
- Practice area: [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts.md)
- Jurisdictions: Australia, New Zealand, United Kingdom (England and Wales)
- AI level: Yellow. AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at: 2026-10-17
- Status: Maintained. Checked on 2026-10-17 against the 7 authorities it cites, for Australia, New Zealand and United Kingdom (England and Wales).

## When to use it

Attach to a SaaS, outsourcing or development agreement where the supplier stores or processes personal information or other customer data. Adapt the incident timings to the customer's regulatory profile. For an EU or UK controller, use the UK GDPR art 28 mapping and add transfer terms.

## How AI may be used

AI may map a vendor's security documentation and data processing terms against this schedule and mark gaps. A lawyer settles notification timing, offshore disclosure analysis and the allocation of breach costs.

**AI may:**

- Extract stated data locations, sub-processors, certifications and retention periods from the vendor's documents into Annexure 1, marking anything unconfirmed.
- Compare the vendor's data processing addendum with this schedule and list gaps with clause references.
- Draft an incident notification template from clause 7.3 for the client's incident response plan.

**AI must not:**

- Must not upload penetration test reports, architecture diagrams or SOC 2 reports to a tool that trains on inputs or is not approved for confidential material.
- Must not conclude whether a data breach is an eligible data breach; that is the customer's assessment.
- Must not change the regulatory notification timings without the lawyer checking the current law.

**The lawyer checks:**

- Whether the customer is an APP entity, a reporting business entity for ransomware payments, or a responsible entity under the SOCI Act, and timings to match.
- The APP 8 position for each offshore location and sub-processor.
- That the schedule takes precedence over the main agreement and the vendor's online terms.

## Authorities

- [Privacy Act 1988 (Cth) Sch 1, APPs 6, 8, 11, 12 and 13; s 16C](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Privacy Act 1988 (Cth) Pt IIIC, ss 26WE, 26WH, 26WJ, 26WK, 26WL (notifiable data breaches)](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Cyber Security Act 2024 (Cth) Pt 3, s 27 (ransomware payment reporting within 72 hours)](https://www.legislation.gov.au/C2024A00098/latest/text)
- [Cyber Security (Ransomware Payment Reporting) Rules 2025 (Cth) ($3 million turnover threshold)](https://www.legislation.gov.au/F2025L00278/asmade/text)
- [Security of Critical Infrastructure Act 2018 (Cth) Pt 2B, ss 30BC, 30BD (cyber incident notification)](https://www.legislation.gov.au/C2018A00029/latest/text)
- [Privacy Act 2020 (NZ) Pt 6, s 114 (notifiable privacy breaches)](https://www.legislation.govt.nz/act/public/2020/0031/latest/whole.html)
- [UK GDPR art 28 (processor)](https://www.legislation.gov.uk/eur/2016/679/article/28)

## Official form

[Official form](https://www.oaic.gov.au/privacy/notifiable-data-breaches/report-a-data-breach)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/data-protection-and-security-schedule and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*