What Should A Data Processing Clause Include?

A data processing clause should set out exactly how your supplier can collect, use, store, protect, share and delete personal information on your behalf.

That sounds simple, but it can get more nuanced once you add SaaS tools, offshore hosting, marketing platforms, subcontractors and customer data into the mix. In New Zealand, your contract should help your business meet its obligations under the Privacy Act 2020, especially where a supplier is handling personal information that still reflects on your brand.

The good news is that this doesn't have to be overly complicated. A clear privacy clause can give you practical control over what happens to personal information, reduce confusion if something goes wrong and make your supplier relationship much easier to manage.

Do You Need A Data Processing Clause In New Zealand?

Yes, if your supplier will access, store or use personal information for your business, you should usually have a data processing clause in the contract.

The Privacy Act 2020 doesn't use the same controller and processor language you may have seen in overseas privacy laws, such as the GDPR. New Zealand law focuses on agencies and personal information, and the Information Privacy Principles, often called the IPPs, set out how personal information must be handled.

Even so, data processing clauses are very useful in New Zealand contracts because they spell out who is responsible for what. This matters where your business collects customer information, but a supplier is the one actually storing it, emailing it, analysing it or supporting the software it sits in.

For example, say you run an online homewares store in Tauranga. You use a SaaS platform to manage orders, a courier platform to fulfil deliveries and an email marketing provider to send promotions. Each supplier may handle customer names, addresses, phone numbers, email addresses and purchase history. If your contracts are silent on privacy, it may be unclear what they can do with that data and what they must do if there's a breach.

A good clause helps answer questions like:

• Can the supplier use your customer data for its own analytics or marketing?
• Can the supplier send the data overseas?
• What security measures must the supplier have in place?
• How quickly must the supplier tell you about a privacy breach?
• What happens to the data when the contract ends?

What Counts As Personal Information In A Supplier Agreement?

Personal information is information about an identifiable person, so your clause should cover any data that could reasonably identify a customer, employee, contractor or other individual.

Common examples include:

• names, addresses, phone numbers and email addresses
• account login details or customer ID numbers
• order history, booking history or support tickets
• payment-related information, although you should avoid storing full card details unless you have a clear need and proper controls
• health, disability, age or other sensitive information
• photos, CCTV images, voice recordings or call notes
• IP addresses, device identifiers and online behaviour that can be linked to a person

If you're sharing de-identified or aggregated data, you should still be careful. If the data can be re-identified, or combined with other information to identify someone, it may still create privacy risk.

Your supplier agreement should define the personal information clearly. This doesn't always need to be a long definition, but it should be broad enough to capture the information the supplier will actually handle.

What Should A Privacy Clause In A Contract Cover?

A privacy clause should cover the supplier's permitted use of personal information, security obligations, breach reporting, subcontractors, overseas transfers and what happens when the contract ends.

At a practical level, your clause should make it easy to answer the question: what is the supplier allowed to do with the personal information, and what are they not allowed to do?

Purpose And Instructions

Your contract should say the supplier can only use personal information for the agreed services and on your reasonable instructions.

For example, if your email marketing provider receives customer email addresses to send your campaigns, the clause should stop the provider from using those addresses for its own marketing or selling them to another business.

You may also want the supplier to confirm that it won't:

• use the personal information for a purpose outside the contract
• try to identify people from de-identified data
• combine your customer data with other data sets except as needed to provide the services
• use your data to train AI models unless you've clearly agreed to that

Security Standards

Your clause should require the supplier to protect personal information against loss, unauthorised access, misuse, modification and disclosure.

Under the Privacy Act, IPP5 requires agencies to protect personal information with reasonable security safeguards. What is reasonable depends on the type of information, the likely harm if it's misused and the nature of the supplier's services.

For a SaaS supplier, you might ask for commitments around:

• access controls and multi-factor authentication
• encryption in transit and, where appropriate, encryption at rest
• secure backups and recovery processes
• staff confidentiality obligations
• regular security testing or monitoring, backed by a clear information security policy where appropriate
• limits on who inside the supplier's organisation can access your data

You don't always need highly technical wording, especially for a small supplier arrangement. But vague promises to keep data safe may not give you enough comfort if the supplier is holding sensitive or high-volume customer information.

Confidentiality

Your supplier should be required to keep personal information confidential and make sure its staff, contractors and approved subcontractors do the same.

This is separate from general confidentiality around your business information. Personal information deserves its own treatment because mishandling it can affect real people and trigger privacy obligations for your business.

How Should A Supplier Data Processing Agreement Deal With Subcontractors?

Your agreement should either restrict subcontractors or require your approval before a supplier lets another party access personal information.

This is especially relevant for SaaS and digital suppliers. Your direct supplier may rely on hosting providers, customer support tools, analytics tools, AI tools, payment providers and offshore development teams. You may not need to approve every low-risk tool, but you should know who can access the data and on what terms.

A sensible subcontractor clause might say the supplier must:

• tell you about any subcontractors that will access personal information
• only use subcontractors that are reasonably secure and reputable
• make sure subcontractors are bound by privacy and security obligations at least as protective as the main contract
• remain responsible for the subcontractor's acts and omissions
• notify you before adding or replacing key subcontractors

The right level of control depends on the arrangement. If a payroll provider is handling employee bank account and tax information, you'll usually want tighter controls. If a design contractor only sees a business contact's email address, a lighter clause may be enough.

What Should The Clause Say About Overseas Data Transfers?

The clause should say whether personal information can be stored or accessed overseas, where that may happen and what safeguards the supplier must use.

This matters because the Privacy Act 2020 includes specific rules around disclosing personal information to an overseas person or organisation. IPP12 is the key rule. In simple terms, if you disclose personal information overseas, you generally need to take reasonable steps to make sure the overseas recipient is subject to privacy safeguards that are comparable to New Zealand's, unless another exception applies.

There can be a distinction between an overseas supplier simply storing or processing information for you, and you disclosing information to an overseas organisation for its own use. That distinction can be technical, so it's worth getting tailored advice if your data flows are complex or involve sensitive information.

Your contract can help by requiring the supplier to:

• tell you where personal information will be stored or accessed
• not transfer personal information to new countries without notice or approval
• use overseas recipients that are bound by comparable privacy protections
• put written contracts or a data sharing agreement in place with any overseas subprocessors
• help you respond to customer questions about where their information goes

If your privacy policy says customer information stays in New Zealand, but your supplier stores it in another country, you could also have a Fair Trading Act 1986 issue if that statement is misleading. Your contract, privacy policy and actual business practices should all line up.

What Happens If There Is A Privacy Breach?

Your contract should require the supplier to tell you promptly about any actual or suspected privacy breach and help you manage the response.

Under the Privacy Act 2020, a notifiable privacy breach is a privacy breach that has caused, or is likely to cause, serious harm. If that threshold is met, the agency must notify the Privacy Commissioner and affected individuals as soon as practicable.

If your supplier suffers the breach, you still need to know quickly so you can assess the risk, contain the issue and decide what notifications are needed. A slow notification from the supplier can make the situation much harder to manage.

Your breach clause should cover:

• what counts as a security incident or privacy breach
• how quickly the supplier must notify you, for example immediately or within a set number of hours after becoming aware
• what information the supplier must give you, such as the type of data affected, number of people affected and steps taken so far
• who is responsible for investigating and containing the breach
• whether the supplier can contact affected customers directly
• who pays for remediation costs, customer communications or expert support

You should be careful about giving suppliers total control over customer communications. If it's your customers' data, you usually want the final say on what is said, when it's said and who says it.

What Should Happen To The Data When The Contract Ends?

Your clause should say whether the supplier must return, delete or securely destroy personal information when the contract ends.

This is often missed in supplier contracts, but it's one of the most practical parts of a data processing clause. If you move to a new CRM, payroll system or booking platform, you need a clean exit plan.

Your contract should deal with:

• how you can export your data
• the format the supplier must provide it in
• how long the supplier can keep backup copies
• whether the supplier must certify deletion
• what happens to archived emails, logs and support tickets
• any legal retention obligations that may apply

Some suppliers may need to keep limited records for accounting, security or legal reasons. That's fine if the contract is clear about what they can keep, why they can keep it and how they must protect it.

Can You Use A Standard Privacy Clause For Every Supplier?

You can use a standard clause as a starting point, but it should be tailored to the risk and the type of supplier.

Templates often miss the practical details that matter most, such as where the data is hosted, whether AI tools are involved, what breach timing applies and whether the supplier can use subcontractors. A clause for a low-risk graphic designer doesn't need to look the same as a clause for a SaaS platform storing thousands of customer records.

A useful way to tailor your clause, or a data processing schedule, is to sort suppliers into risk levels.

Lower-Risk Suppliers

These suppliers may only see limited business contact details or low-sensitivity information. You may still want confidentiality, permitted use, basic security and deletion obligations, but the clause can usually be shorter.

Medium-Risk Suppliers

These suppliers may handle ordinary customer records, bookings, order histories or marketing lists. You should usually add clearer rules around security, subcontractors, breach notification, overseas access and data return.

Higher-Risk Suppliers

These suppliers may handle sensitive information, large volumes of personal information, employee data, health information, payment-related details or core business systems. You may need stronger security commitments, detailed breach procedures, audit rights, tighter subcontractor controls and clearer liability settings.

For example, Mia runs an Auckland fitness studio and uses a booking app that stores member names, phone numbers, emergency contacts, attendance records and some health notes. That supplier should be treated as higher risk than a printer who only receives first names for class certificates. Mia's contract with the booking app should be much more specific about security, support access, overseas hosting and breach notification.

What Other Contract Terms Should Sit Alongside The Data Processing Clause?

Your data processing clause should work alongside the rest of your supplier contract, not sit alone.

Privacy obligations often connect with other commercial terms. If those terms don't line up, you may have a clause that looks good but is hard to enforce in practice.

Check that your agreement also covers:

• scope of services: what the supplier is actually doing with the data
• liability: who is responsible if a privacy breach causes loss
• indemnities: whether the supplier must cover certain costs caused by its breach of the agreement
• insurance: whether the supplier needs cyber or professional indemnity cover
• audit or reporting rights: how you can check compliance, especially for higher-risk suppliers
• change control: what happens if the supplier changes hosting locations, subprocessors or security practices
• termination rights: whether serious privacy or security failures let you end the contract

You should also make sure your own customer-facing privacy policy matches your supplier arrangements. Under the Privacy Act, IPP3 requires you to be transparent when collecting personal information, including why you're collecting it and who may receive it. If your policy says one thing and your supplier arrangements do another, that gap can create risk.

Key Takeaways

• A data processing clause helps control how suppliers and SaaS providers handle personal information for your business.
• New Zealand contracts should reflect the Privacy Act 2020, especially the IPPs, IPP5 security obligations, IPP12 overseas disclosure rules and notifiable privacy breach requirements.
• Your clause should cover permitted use, security, confidentiality, subcontractors, overseas transfers, breach reporting and data return or deletion.
• The wording should match the supplier's risk level. A payroll, booking or CRM provider usually needs stronger privacy terms than a low-risk supplier.
• Your supplier contract, privacy policy and actual data practices should line up so customers aren't misled about how their information is handled.

If you'd like help with your supplier privacy clauses, SaaS contracts, data processing terms or privacy policy, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.