On this page
Read the terms in context
Collect the master terms, order form, data-processing agreement, product-specific policy, acceptable-use policy, security addendum, renewal notice and any negotiated amendment. Record the version and effective date. A public web page can change, while an order form may narrow or expand it. Keep the signed or accepted version with the review record.
General information, not legal advice.
Contract audit worksheet
General information, not legal advice.
| Question | Evidence to mark | Outcome to record |
|---|---|---|
| Who owns customer content and derived material? | Ownership clause, definitions and exclusions | Owner, vendor, shared or unclear |
| May the vendor use data for service improvement or model training? | Purpose, license grant and product policy | In, out, opt-out, consent needed or unclear |
| May the vendor retain backups or logs? | Retention, backup and deletion sections | Period, evidence and unresolved residue |
| May the vendor sublicense or disclose data? | Subprocessor and affiliate language | Recipients, scope and approval path |
| Does the vendor restrict customer or third-party data? | Confidentiality, acceptable-use and sector terms | Exclude, obtain consent or counsel review |
| Is the right exclusive or irrevocable? | License term, exclusivity and termination language | Conflict, carve-out or no conflict |
| What happens on account closure or a change of control? | Suspension, termination and assignment clauses | Preserve, export, notify or escalate |
| What evidence can the vendor provide? | Export, deletion, audit and incident clauses | Evidence available, unavailable or unknown |
| Which law and venue apply? | Governing-law and dispute sections | Jurisdiction for counsel review |
Do not write “the vendor owns our data” from a broad service license. Do not write “we own everything” from a customer-content clause. Read the defined terms, exclusions and derivative-work language together. The answer can differ by data type and plan.
Privacy and processor questions
If a vendor processes personal information on your behalf, ask who decides the purposes, what instructions apply, which subprocessors are used, how access is limited and when deletion is evidenced. UK regulator guidance on data protection by design says controllers should use only processors that provide sufficient guarantees and should secure personal information with measures such as encryption or pseudonymization UK data protection regulator, (opens in a new tab). That guidance does not tell you how your contract is classified. Counsel must apply the relevant law.
General information, not legal advice.
Worked fictional example
A fictional company reviews its hosted support system. The master terms say the company owns customer content, the product policy permits limited service improvement, the order form excludes model training, and the DPA names a retention period. The audit marks customer tickets review, synthetic test tickets candidate, and vendor-generated metadata counsel review. It does not conclude that the archive can be licensed. The company must confirm whether the order form controls, whether the exclusion applies to the historical period and whether customer contracts allow the proposed use.
If the terms conflict, narrow the archive, obtain an amendment or written customer permission, or leave the affected records out. Keep the conflict visible in the ownership pack. A missing answer is not consent.
General information, not legal advice.
Sources
- Rightmark: Buyers
- Rightmark: Data licensing for AI
- UK data protection regulator: Data protection by design and by default (opens in a new tab)