Data processing addendum for cybersecurity vendors

A general services agreement often does not deal with the detail clients expect when your business hosts, monitors, analyses or otherwise handles personal information as part of a security offering. A dedicated addendum can set out who is acting on whose instructions, what security commitments are being made, whether subprocessors are involved, how incidents are notified and what happens to data when the arrangement ends. That matters because the legal position depends heavily on how information is handled in practice, not just on broad promises in a master contract.

It commonly covers the parties' roles, the categories of information involved, the permitted processing activities, confidentiality obligations, security measures, use of subprocessors, assistance with privacy-related requests, incident notification, audit or information rights, overseas handling points and deletion or return of data on exit. For security vendors, there may also be close attention on logging, monitoring access, managed detection services or support access to client environments. The exact drafting turns on your service model, because the right approach depends on the factual context and the documents already in place.

We usually need a practical outline of your service, including what data you handle, whether you host or merely access it, which subcontractors or cloud providers are involved, whether information is stored or accessed outside New Zealand, and what your client contracts already say. If you already have a master services agreement or a client-supplied addendum, that is useful too. These details matter because a security vendor that monitors systems directly may need different wording from one that only provides software tools or advisory services.

A template may be useful for orientation, but it often misses the operational details that decide whether the wording works for your business. However, it often stays too generic once enterprise customers ask detailed questions about subprocessors, audit rights, breach reporting, support access or data location. Security vendors also face pressure to align contract wording with what their systems and teams actually do day to day. If the document overstates your controls or misses a real operational step, that can create negotiation problems later. This service We will make the key issues clear so you can decide what to do next. with every customer or procurement team.

Timing depends on how quickly we receive clear instructions, whether there is an existing document to review and how complex your service model is. In many matters, the next step is for you to provide your current agreement set, any client mark-up or procurement requirements, and a short summary of your data flows. We then review the material, prepare the addendum or comments, and come back with the legal drafting work covered by the fixed-fee. Broader negotiations, technical remediation and ongoing representation sit outside this service.

Submit an enquiry on this page or click 'Get started'. One of our legal consultants will review it within 1 business day and get in touch to understand what you need.

Your consultant will then email you a fixed-fee quote setting out the cost, scope and timing. If you're happy with it, you can accept the quote and sign our engagement letter online.

Once you've accepted, one of our Australian-qualified lawyers will work with you to complete your project. They'll contact you by email or phone if they need anything.

Sprintlaw works on fixed-fee pricing wherever possible, so you can review the scope and cost before you decide whether to proceed. For the Security Vendor Data Processing Addendum service, pricing starts from $900.00.

After you enquire, a legal consultant will confirm what is included, the expected timing and whether any extra work is needed before you engage us.

We work online, so we can help wherever you are in New Zealand. Our team works remotely, mainly from Australia.

Your work is done by our Australian-qualified lawyers, who hold Australian practising certificates and specialise in business law. None of them are New Zealand lawyers or hold a New Zealand practising certificate.

Sprintlaw NZ Limited is a legal consultancy, not a law firm, and is not regulated by the New Zealand Law Society. We don't act in court or tribunal matters, conveyancing (including leases and business sales) or other reserved areas of work. Communications with Sprintlaw are unlikely to be protected by legal professional privilege. We still keep everything confidential under our engagement letter.