Data Protection Contract Clauses Between Companies

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Data protection clauses in contracts between companies are essential for complying with the LGPD (Brazil’s General Data Protection Law) and avoiding joint and several liability when a security incident occurs.

Why data protection clauses are indispensable in B2B relationships

When two companies enter into a contract that involves sharing personal data, the General Data Protection Law (Law No. 13.709/2018) imposes obligations on both parties. It makes no difference whether the contract is for services, a commercial partnership, or outsourcing: whenever personal data is processed, each party’s responsibilities must be clearly defined in specific clauses. Ignoring this requirement can lead to administrative sanctions imposed by the ANPD (Brazil’s National Data Protection Authority), as well as lawsuits filed by data subjects who have been harmed.

In practice, we see many companies still treat data protection clauses as a mere contractual appendix, inserting generic provisions that do not reflect how the data is actually processed. That approach falls short. The LGPD requires controllers and processors to set out, transparently and in detail, the purposes of the processing, the categories of data involved, retention periods, the security measures that apply, and the procedures for reporting incidents. Vague or boilerplate clauses that do not match operational reality create a false sense of compliance, one that quickly falls apart when an inspection or a data leak occurs.

We also need to consider the question of liability. Article 42 of the LGPD provides that a controller or processor who causes property, moral, individual, or collective damage in violation of data protection legislation is obliged to repair it. If a processor handles data unlawfully, the controller may be held jointly and severally liable if it has not taken adequate contractual and technical precautions. Well-drafted clauses, then, are not merely good practice: they are instruments of legal protection for both parties.

Essential elements of a data protection contract clause

For a data protection clause to do its job, we need to build it from both mandatory and recommended elements. The first is a precise definition of each party’s role. The LGPD distinguishes between the controller (who makes the decisions about processing) and the processor (who carries out the processing on the controller’s behalf). This designation must appear expressly in the contract, because different obligations flow from each role. In many commercial relationships, both parties act as independent controllers, which calls for a different contractual approach from the one used in a controller-processor relationship.

Data protection contract clauses are not a bureaucratic formality: they are a company’s main line of legal defense when an incident involves shared personal data.

The second fundamental element is a description of the processing activities. We need to specify which categories of personal data will be shared (registration, financial, or sensitive data), the purposes of the processing, the applicable legal basis (consent, performance of a contract, legitimate interest, or others set out in Article 7 of the LGPD), and the estimated volume of data and number of data subjects involved. This description lets both parties understand exactly what the processing covers and put in place security measures proportionate to the risks identified.

We should also include clauses on technical and administrative security measures. The party receiving the data must commit to minimum standards of protection, such as encryption, access controls, log recording, employee training, and periodic vulnerability testing. We recommend that the contract provide for an audit right, allowing the controller to verify, with reasonable advance notice, that the processor is meeting the agreed security obligations.

Handling subprocessors

One issue often overlooked in contract clauses is the use of subprocessors. When the contracted processor needs to subcontract third parties to carry out part of the data processing, the contract must expressly allow for this. It should state whether the controller’s prior authorization (specific or general) is required and require the subprocessor to be bound by equivalent data protection obligations. Without such a provision, we create an opaque chain of responsibility that makes data harder to trace and increases the risk of incidents.

International data transfers

If the contractual relationship involves sending personal data outside Brazil, the clauses must address the international transfer mechanisms provided for in Article 33 of the LGPD. This includes verifying that the destination country offers an adequate level of protection or, absent such adequacy, adopting standard contractual clauses, global corporate rules, or other instruments recognized by the ANPD. This matters especially when Brazilian companies use cloud computing services whose servers are located abroad.

Incident management and notification: what the contract should provide

One of the most critical aspects of data protection clauses between companies is setting out procedures for managing security incidents. Article 48 of the LGPD requires the controller to notify the ANPD and the data subject of any security incident that may result in relevant risk or harm. For the controller to meet this duty within the regulatory deadline, the processor must be contractually obligated to notify it immediately (or within a specific maximum period, such as 24 or 48 hours) after learning of any incident affecting the data covered by the contract.

The contract should spell out the minimum content of this notification: the nature of the data affected, the estimated number of data subjects involved, the likely consequences of the incident, the measures already taken to contain the harm, and the contact person responsible for communications. We also recommend that the clauses require cooperation in investigating the incident, including providing logs, technical reports, and access to the affected systems.

Another point that deserves attention is how the contract defines the consequences of an incident caused by one party’s negligence. Indemnification clauses, limitations of liability, and rights of recourse are legitimate tools for allocating economic risk proportionately. We must be cautious, however: clauses that excessively limit the processor’s liability may be challenged in court, especially when the affected data subjects are consumers protected by the Consumer Protection Code.

Data due diligence: evaluating your partner before you sign

Even before drafting the contract clauses, we recommend that companies conduct data protection due diligence on the prospective business partner. This preliminary assessment helps identify how mature the other party is in its LGPD compliance and gauge the risks of sharing data. Effective due diligence covers several areas: confirming that a privacy governance program exists, reviewing information security policies, checking the history of incidents, assessing security certifications (such as ISO 27001), and verifying that a data protection officer (DPO) has been appointed.

We identify three levels of depth for this due diligence, depending on the risk involved in the operation. For sharing basic registration data in small volumes, a standardized assessment questionnaire may be enough. For operations involving sensitive data or a large number of data subjects, we recommend technical interviews with the information security team and a review of internal policies. In the most critical cases (such as full outsourcing of operations involving health or financial data), due diligence should include site visits and security testing in the partner’s environments.

The results of the due diligence feed directly into how the contract clauses are drafted. If the assessment shows that the partner’s data protection program is immature, the clauses should be more restrictive, with additional security obligations, more frequent audits, and shorter incident notification deadlines. If the due diligence shows a high level of maturity, the clauses can be proportionately less detailed on technical points and focus on the essential regulatory obligations.

Term, retention, and end of data processing

Contract clauses must clearly govern what happens to personal data when the contract ends. Articles 15 and 16 of the LGPD set out when processing ends and the rules on data deletion. The contract should therefore state whether the data will be returned to the controller, deleted by the processor, or retained to comply with a legal or regulatory obligation. In every case, it is essential to set specific deadlines for each of these steps.

We recommend that the contract include a retention clause specifying maximum storage periods for each category of data, tied to the corresponding legal bases. Data kept to meet a tax obligation, for example, is subject to retention periods set by tax law, while data kept solely to perform the contract must be deleted as soon as the purpose has been achieved. The clause should also specify the method of deletion (secure destruction, irreversible anonymization) and require the processor to issue a certificate of deletion.

One aspect that often leads to disputes is which obligations survive after the contract ends. Confidentiality clauses, clauses on cooperation during an ANPD inspection, and indemnification clauses should remain in force for a reasonable period after the contractual relationship ends. In our analysis, a five-year period is consistent with the limitation periods that apply to most of the claims involved, although each case deserves its own assessment.

This topic is directly related to impact report on, a subject we cover in a dedicated article.

This topic is directly related to sensitive data under the LGPD, a subject we cover in a dedicated article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.