Personal data handling clauses in service and SaaS contracts

Hello, this is Legal Agent.

Some contracts reduce the entire personal data provision to a single sentence: "The Contractor shall comply with the Act on the Protection of Personal Information (APPI)." Because statutory compliance is already mandatory regardless of contract language, a personal data clause serves a different purpose: defining what the general law leaves open for the specific transaction. That means setting out who handles which personal data, for what purpose, within what boundaries, and under what rules if subcontracting or a breach occurs.

Identifying the data and each party's role

Review begins by identifying the categories of data involved and each party's legal role. Basic contact details such as names and email addresses raise different considerations from purchase histories, applicant records, or health data, especially when sensitive personal information is present. The legal role also shapes every obligation: whether a company acts as the entrusting party, an entrusted service provider, a joint user, or a third-party recipient. Tracing the operational data flow, rather than asking whether personal data is involved in the abstract, helps identify which duties and permissions need to be addressed.

Processor management in outsourcing arrangements

When the handling of personal data is outsourced, Article 25 of the APPI requires the entrusting party to exercise necessary and appropriate supervision over the entrusted party. The drafting challenge lies in turning that statutory duty into workable provisions, including the scope of delegated work, specific security measures, and data return or deletion upon termination. Subcontracting often proves the most contentious point. Where the service needs subcontractors, consider whether consent or advance notice, together with an updated list, can provide suitable control. The choice should reflect the data and risks, rather than assuming that either a blanket ban or permission is always appropriate.

Data use in SaaS and AI services

In SaaS and AI contracts, personal data terms usually coexist with general terms of use, privacy policies, and separate data processing agreements. For the customer, the key question is how far the provider may use input or usage data for service improvement, model training, or customer support. Ask what anonymization or aggregation actually involves; the label alone does not establish that the data meets the APPI’s statutory requirements for anonymously processed information.

Not every SaaS or AI arrangement is outsourcing. Where the contract provides that the provider does not handle the data and appropriate access controls support that arrangement, the service may fall outside third-party provision and Article 25 supervision, while the customer’s own security duties remain. Necessary-purpose outsourcing may fall within Article 27(5)(i), but provision to a foreign recipient requires a separate Article 28 assessment, including relevant exceptions and equivalent-protection arrangements. Server location alone does not settle that question.

Making breach response concrete

A clause promising only prompt notice "in the event of an incident" offers little practical guidance during an actual crisis. Effective review sets clear definitions for reportable events, specific notice deadlines, required initial report content, investigation support, responsibility for notifying individuals and regulators, cost allocation, and damages. The contractual reporting obligation may cover events beyond the statutory reporting cases under Article 26. Legal duties cannot simply be reassigned or waived by contract; check any statutory exception, including notification by an entrusted party to the entrusting party. Set reporting duties the provider can meet without preventing necessary incident response or legal compliance.

Checking against the DPA and privacy policy

When parties execute a separate data processing agreement, it often contains detailed operational terms on subprocessors, cross-border transfers, and technical safeguards. The main contract and the processing agreement must align, with an explicit order-of-precedence clause to govern conflicts. A similar comparison is necessary for the privacy policy. Aligning what the contract permits, what has been disclosed to data subjects, and how systems actually operate helps identify promises or disclosures that need correction. “Processor” in this article describes an entrusted service provider; it does not mean that GDPR duties automatically apply to every APPI outsourcing arrangement.