Seven contract questions for a measurement supplier, from data roles to exit

Privacy first measurement commercial contracts should answer seven operational questions before they allocate financial risk. The contract cannot turn a controller into a processor by description alone, nor transfer away an organisation's statutory accountability.

What to take away

A contract cannot turn a controller into a processor by description alone.
Documented instructions must cover subject matter, duration, nature, purpose, personal-data types and people.
Security evidence should be proportionate to risk and not rely on a certificate alone.
Exit terms should include export format, assistance, timetable, deletion or return, and backup treatment.
Test an export before dependency becomes critical.

How this list was assembled

Research date: 5 September 2026.

Inclusion: a topic had to affect the verifiable operation, governance or exit of a measurement service and have direct support in current ICO, NCSC or government material.

Geography: the buyer scenario is England. UK GDPR duties have UK reach. Governing law, jurisdiction, remedies and interpretation may differ across England and Wales, Scotland and Northern Ireland, so this article does not call them one body of UK contract law.

Exclusions: supplier rankings, template clauses, untested warranties, assumed legal roles, price benchmarks and advice on negotiating liability caps.

The order follows the life of a service, not a score. Each entry is a contract question rather than a named vendor. Counsel qualified for the chosen law should draft and review the final agreement.

1. What does each party decide?

Map who chooses purposes, essential means, recipients and reuse. The ICO's controller and processor guidance bases status on actual responsibilities. If a supplier uses data for an independent purpose, a processor label in the schedule cannot settle the issue.

Contract action: attach a responsibility matrix and require notice before conduct changes.

2. What are the documented instructions?

For a controller-to-processor arrangement, describe subject matter, duration, nature, purpose, personal-data types and people concerned. The ICO's contract guidance identifies required terms and explains that processors act on documented instructions, subject to applicable legal duties.

Contract action: link permitted events, destinations and reports to an approved specification.

3. Which security evidence is inspectable?

Ask for controls proportionate to the information and service risk, then define how assurance will be supplied. The NCSC's supply-chain control principles recommend setting justified security requirements in contracts and passing suitable requirements to subcontractors.

Contract action: specify evidence dates, incident contacts, reporting windows and remediation follow-up. A certificate alone should not end the inquiry.

4. Who may appoint a sub-processor?

The agreement should state whether authorisation is specific or general, how changes are notified and what happens after an objection. ICO contract material also addresses the flow-down of equivalent data-protection obligations.

Contract action: maintain a current list showing service, location, purpose and effective date for each sub-processor.

5. Where can personal information travel?

Hosting language does not reveal every support, access or onward-transfer route. The ICO's international-transfers guide uses a three-step test for identifying a restricted transfer and explains that other UK GDPR obligations still apply.

Contract action: record locations and access paths, required transfer mechanism, change control and evidence the exporter must retain.

6. Can the buyer reproduce the reported claim?

Define event acceptance, deduplication, attribution settings, modelled outputs, data freshness and correction procedures. This is a commercial evidence question as well as a technical one. The CAP Code misleading-advertising rules require evidence for objective marketing claims before publication.

Contract action: secure export rights, calculation documentation and an audit route adequate for the claims the buyer expects to make.

7. What happens at exit?

Contract action: test an export before dependency becomes critical. Have commercial counsel align termination, intellectual property, liability and dispute terms with the chosen law of the agreement. None of these clauses certifies that the service itself is compliant.

Before you act

Attach a responsibility matrix to the contract.
Link permitted events to an approved specification.
Specify evidence dates and incident reporting windows.
Maintain a current list of sub-processors.
Record locations and access paths for transfers.
Secure export rights and calculation documentation.

Common questions

How does the ICO determine whether a party is a controller or processor?

The ICO bases status on actual responsibilities, not labels. If a supplier uses data for an independent purpose, a processor label in the schedule cannot settle the issue. A responsibility matrix and notice before conduct changes are recommended contract actions.

What should be included in documented instructions for a processor?

For a controller-to-processor arrangement, describe subject matter, duration, nature, purpose, personal-data types and people concerned. The ICO identifies required terms and explains that processors act on documented instructions, subject to applicable legal duties. Link permitted events, destinations and reports to an approved specification.

What exit provisions should a measurement contract include?

State the export format, assistance, timetable, deletion or return choice, backup treatment and evidence of completion. ICO controller-processor guidance includes end-of-contract provisions among the required subjects. Test an export before dependency becomes critical and align termination, intellectual property, liability and dispute terms with the chosen law.