Rules and ethics
Ten email software contract areas to specify before you sign
Ten email software contract areas to specify, covering roles, Article 28 particulars, sub-processors, transfers, security, service levels, price, liability and exit.
A seasonal campaign is approaching, and an England-based organisation has a draft email platform contract waiting for approval. The buyer does not assume that the paperwork is adequate because it looks familiar. Instead, the team follows the draft from campaign planning through daily operation and eventual departure, recording what it checked, what remained unclear and what it asked to change.
The signature is held against a live campaign
The buyer's decision is conditional: the draft must describe a service the organisation can operate, govern and leave. The scenario uses no named supplier or signed terms.
The team reviews the agreement, order form and incorporated online terms as one proposed arrangement, rather than treating a data-processing schedule as the whole contract.
The review unfolds in six moves
The six moves below cover ten contract areas, which are listed by name after the sixth move. The team works through the proposed campaign in sequence. Each move connects a contract question to a practical check and a decision, so that unresolved wording can be sent back before signature rather than discovered after the service becomes part of campaign operations.
- Situation and scope.The buyer starts with the seasonal send and records who chooses its purpose, eligible recipients and essential means. It compares those decisions with the draft's labels for the parties. Where the supplier acts as processor, the roles and instructions must reflect the actual arrangement, not simply repeat a label from the schedule.
- What the draft says.The team checks whether the processor terms specify the subject matter, duration, nature and purpose of processing, personal-data types and data-subject categories. It also looks for permitted instructions and a way to raise an instruction the processor considers unlawful. The finding is that contract particulars need to be explicit, not left to assumptions about how campaigns normally run.
Article 28 mandatory particulars
- Subject matter of processing
- Duration of processing
- Nature and purpose
- Types of personal data
- Categories of data subjects
At the 5 September 2026 review point, the buyer notes that ICO contracts guidance is marked under review following the Data (Use and Access) Act. It does not treat that note as a substitute for checking the guidance status at signature. The team records the applicable wording and asks for any mismatch between the draft and the real processing arrangement to be corrected.
- Routes and changes. The buyer lists the current subprocessors, their functions and locations, then checks support access, remote administration and onward transfers as well as primary hosting. It finds that a supplier page which can change without notice does not give the team a reliable chance to assess a new dependency. The contract therefore needs notice, objection and remediation routes, with responsibility for transfer evidence assigned. The team cross-checks the UK-EU transfer routes.
For international transfers, the buyer consults the ICO January 2026 guide and its three-step transfer assessment. It asks the draft to identify who maintains the relevant evidence and who responds when legal requirements change. This check leaves the team with a named responsibility to negotiate, rather than an unanswered assumption that the supplier will manage every access route.
- Evidence and response. The security review checks for named provisions covering access control, logging, encryption boundaries, backup responsibility, vulnerability handling and delivery of evidence. The buyer asks for an incident notification period that supports the controller's assessment. It also uses NCSC secure SaaS guidance to keep customer configuration and recovery responsibilities visible in the contract discussion.
The assurance wording is checked for report scope, period, exceptions and renewal. If routine evidence leaves a material risk unanswered, proportionate information requests or an audit route, such as the documents in a vendor due diligence request, should remain available. The finding is that a certificate alone does not show whether the buyer's own configuration is secure or compliant, so the requested evidence must address the service and its use.
- Service and price. The team makes service standards operational by checking the availability calculation, excluded downtime, maintenance notice, support hours, severity levels, response targets and remedies. It names an owner for escalating a blocked send or suppression failure. It also records that a service credit may not remedy a missed statutory or customer deadline.
Next, the buyer checks the billable unit, counting rules, tax treatment, overage process, currency, term, indexation, notice periods and renewal mechanism. It tests duplicate contacts, archived records and seasonal peaks against cost scenarios, then seeks an agreed basis for price changes rather than relying on an undated sales quotation.
- Exit and decision. The buyer compares liability caps, exclusions, indemnities and insurance with the campaign, data and continuity exposure. If the agreement involves consumers, CMA unfair contract terms guidance is relevant to consumer agreements, but the team does not assume it governs every business-to-business negotiation.
The team then checks usable export formats, field definitions, preference history, authentication assets, deletion timing, confirmation evidence, backup and legal retention terms. It asks for transition support and rehearses an export before dependence grows. The check must show whether suppression records and data history can actually be recovered, not merely promise that data can be returned.
Qualified UK privacy, cybersecurity and commercial lawyers review the negotiated text, order form and incorporated web terms together. The buyer holds signature if roles conflict, an essential schedule is missing, price can change without a workable exit, or suppression and data history cannot be recovered. Campaign decisions are kept in a durable campaign record.
The ten contract areas to specify
Taken together, the six moves cover these ten areas. Each needs its own wording in the agreement, order form or incorporated terms.
- Roles and instructions.Who is controller and who is processor, and what the supplier may do only on documented instructions.
- Article 28 particulars.Subject matter, duration, nature and purpose of processing, personal-data types and data-subject categories.
- Sub-processors.A current list with functions and locations, plus notice of changes, a right to object and a remedy.
- International transfers.The transfer route used, who holds the evidence and what happens when the legal position changes.
- Security and incident notice.Access control, logging, encryption, backups, vulnerability handling and a notification period you can work with.
- Assurance and audit.Report scope, period and exceptions, with a proportionate information or audit route if risk remains.
- Service levels.Availability calculation, excluded downtime, support hours, severity levels, response targets and remedies.
- Deliverability commitments.Support for sender authentication (SPF, DKIM and DMARC), handling of bounces, complaints and suppression lists, and help when a mailbox provider blocks or throttles your mail.
- Price, term and renewal.The billable unit, counting rules, overage, indexation, notice periods and an agreed basis for price changes.
- Liability and exit.Caps, exclusions and indemnities, then export formats, deletion timing and recovery of suppression records and preference history.
Area 8 matters because the platform exists to get mail delivered. A contract that is silent on authentication support or on who acts when complaint rates rise leaves the buyer with a service level that measures uptime but not inboxing.
The decision leaves four tests behind
The scenario ends with four linked tests: the parties and instructions match the way campaign decisions are made; operational and transfer evidence has an owner; usage, renewal and liability are understandable; and export, deletion and recovery work before reliance on the platform grows.
A failure in any one remains a reason to resolve the wording before approval.
The buyer also keeps the evidence trail useful after negotiation. It records which terms were checked, which changes were requested and what remains dependent on configuration or operational ownership. Those records make later review more durable than relying on recollection, particularly when the service, campaign process or contract terms change.
