I do not think there are any legal roadblock to do so, if the parties agree to make the amendment that should be it.

what you need to add to the master agreement are clauses derived from Art. 28. I am also doing the same for my Master Agreements. Here is an example,
Obligations of processors (supplier) in particular include:
- To comply with the GDPR data processing principles and to protect the rights and freedoms of data subjects;
- To demonstrate compliance with the GDPR;
- To maintain records of processing activities and make them available upon request by supervisory authorities;
- To appoint data protection officers or representatives;
- To cooperate with supervisory authorities in the performance of their tasks;
- To ensure a level of security by taking appropriate technical and organisational measures;
- Specific obligations as regards transfer of data outside the EU.
In general, an auditor (DPA) should be able to trace data regarding customers. This also include emails, Excel spreadsheets with links to external systems such as financial and banking, etc.
It is not enough to have a supplier follow the GDPR. It is of most importance that your company/organisation is also GDPR compliant. To start with you need to have a DPO.

As mentioned by Amir there are a number of elements to include, and depending on your organisation and the data you are processing you may need to identify a DPO.

Other things you should identify include:

Is the relationship with the supplier a Controller-Processor, Processor-Sub Processor or Controller-Controller.
Is special data being transferred to the supplier?
Will the supplier be exporting data outside of he EU?

You may also want to include an indemnity clause in case the supplier causes you to breach the GDPR regulation.


If you go to the Information Commissionaire's Office website in the UK (ICO.org.uk) there are some excellent guides and information which may assist you (including links to Article 29 Working Party).

Regards

Carl

Hi, this is not something to answer without knowing more details. Interesting to know is who is the data processor and who the data controller? What kind of data flows will there be? How sensitive is the personal data involved in this.. etc etc.. You may want to look at the liability limits...

Hi,
The question is what this deal is all about. There will be a different approach to just shipping some goods vs. complicated outsourcing contract which you process personall data for. Remember that you need to remeber that even contact details stated in the agreement for e.g. contract managers are considered to be under GDPR scope. What my concern is, you very likely act as processor for your customer. The buyer's organization is the Administrator. Did they raise any particular matter.
It looks like you are outside of Europe. GDPR is not only about the DPA to stay compliant. You as a processor have certain duties to fulfill. If your company is not on Privacy Shield list (which in fact may soon become invalid just as Safe Harbour) according to some media news, it could be better to have Standard Contractual Clauses in place.
The topic is very broad and without more details it is difficult to help you.
Regards,
Piotr

IACCM conducted a Ask The Expert webinar on this topic, featuring James Mullock of Bird and Bird. His session was highly rated. The recording and James's presentation are in the IACCM Library. Plus, there are a few other resources in the IACCM Library which are relevant. If you have trouble finding these resources, please let me know.

Best Regards,

Jim Bergman
IACCM

You can also have a look at the Article 29 Working Party webpage - there is a page setting out draft contract provisions that are in line with the GDPR as it is currently being interpreted. You may not want to use the clauses themselves but can use them as a measure for your own inclusions.

Hi,
Happy to provide some information on software that can help you quickly and efficiently overcome this cumbersome challenge.

Depending on the nature of the agreements and the industry, there are likely to be ways that IACCM can assist you with appropriate sources of review. Please get in touch with further details. My email is tcummins@iaccm.com

Thanks Jessica for posting this question. I appreciate all the inputs from everyone most especially Jason's reply. Like many others, suggesting to our vendors the use of our company templates for professional services is always a challenge. But as Jason suggested, explaining the benefits of using the company template (e.g. easy approval of subsequent statements of work once an MSA has been approved) makes the vendor think and eventually agree. Of course, there is negotiation in the process. It is not a straightforward demand of asking them to accept the template per se but making them aware of the benefits does help.

Since this discussion started almost 2 years ago, the world of technology has progressed and IACCM can today offer a service to validate 'contract norms'.

A challenge for buyers and suppliers is that their templates start from positions of self interest and naturally this creates contention and delay. It is now quick and relatively easy for us to provide members with insight to what is a normal position / term for any particular type of. Ontract. This allows internal discussion of the desirable business position and of course informs external discussion to accelerate agreement.

Even though it has been a long time since Jessica posted this, I would like to add my comment (may be somebody is still interested in this topic). Usually, I don't face problems with internal clients in the way they don't want to share the template with our customers. On the other hand of course, customers sometimes come back with their template (instead of any comments/tracked changes in our template) or, if not such a "strong" company to insist on their template, they send our template back with all important clauses deleted and replaced with their template wording. Sometimes it is just a matter of wording, and when I see the content is the same and can imagine how long would it take them to have our wording reviewed and approved, I agree with theirs instead. However, sometimes it is really a totally different story, setting us in such an unpleasant situation, that the best option would be not to sign the contract at all. What I learned is, that is not only a question of the size of a company or its hierarchy (=how many approvals do they need), it is often also a "cultural" thing. Some nations have negotiations or even fighting for a win in their veins, and they push back just as a matter of principle. When you set up relevant points in front of them, they usually agree and you get their respect. A great distinguishing model here is the one of Hofstede, which was also mentioned in one of the modules.
Coming back to Jessica's comment, I sometimes face a different problem - internal clients wish to send the template immediately to the customer without any prior discussions or involvements of Contracts. They simply tend to find somewhere a blank template and go out. I always need to explain, that Contracts need to see it and that we, Contracts, are the one responsible for it. Even though using a template, every single deal is unique and a template needs to be adjusted not only with regards to the deal's specific, but also based on our experience with the customer (e.g. I know Czech companies insist on having their ID and information about incorporation in the legal name and address description - if I wouldn't place it in the contract prior sending to the customer, we would look stupid and like we don't care about customer's needs at all. the same is with Russian customers, who, due to their law requirements, need to have bank details explicitly written in the agreement - so I won't release any draft for their review without inserting those bank details).
So I think nobody can only focus on one side of the business - I believe it is not only about customers (CRM) but about relationship with the internal clients (trusted advisor) as well.

Hi Jessica
This is a common problem. Many of the relationships with indirect
suppliers are less formal and may have been in place for years, leading to resistance over use of standard templates.

It is of course important to establish whether the issue is just general resistance or whether the standards are not really appropriate to the range of indirect relationships required, or lack required flexibility.

We do have benchmark data at IACCM on cycle times and will be issuing reports on the latest information at the end of April. It should be possible to provide interim data if you need it sooner.

Tim

Internal Template application rather than the one of the supplier is usually a requirement nevertheless the real issue behind is do we protect ourself correctly. Legal usually is validating a template that he wants verybody contract manager to apply. As legal ressources are scarce and expensive ressources it is ovious that this is the first thing that should be pushed. Once you know that he does not work the more complex but more interesting solution for the company is to look at the mandatory clauses that are requested from the contract. So instead of pushing your template you should fight on the mandatory clauses. Fall back position should be created as a handbook of best practices.

Ms. Prendergast,

Templates, while easy to copy and work with, present a challenge to many companies in part because the template is usually written from one side or the other, providing all the advantages to the author's side and none to the recipient. This is frequently seen in EULAs, where the equivalent of "Not only do we have all the rights, but you are lucky we let you use our product at all, you horrible little vendor!" is common contract parlance.

So how do you overcome the natural inclination of a vendor to resist your templates? The same way you advertise anything else!

Make the option of using your product (the templates) both appealing and advantageous to the vendor. When sending internal templates to a vendor for use, do not present them as a "use or lose" option. Instead, deliver the items with the contracting equivalent of a box of chocolates: Provide vendors a summarized explanation of the benefits offered through using your templates. Bullet-oriented briefs are more effective here, as they provide not only a quick list for the vendor to read, but a point-summary for the vendor's contract manager to use in presenting the overwhelming benefits offered by your templates to their management.

Explain (again in short form) the potential realized cost savings of template use, including ease of follow-on contract development by way of utilizing your "easily-tailored, customer-specific templates." Make every effort to ensure using your templates is so much easier than having the vendor's contract department reinvent the procurement wheel that the vendor (who at this point you should view as your customer) would actually be acting against their own best interest to do anything other than to use your templates.

As M. Fouquier rightly points out, the usual greatest challenge is getting your templates past the legal department guardians. Providing a brief mandatory clause list may be a more advantageous initial step, as it tends to ease legal's protective instinct toward its client(s). Once you present not merely a palatable offering of clauses, but a tasty array of work-easing options to the vendor (and the vendor's legal counsel), your job is 90% done. Offering updates and non-critical individual tailoring options (which would not, of course, change the mandatory clauses) gives the vendor the personalized attention so critical to obtaining their final approval. It is the after-dinner apertif of contracting: "Not only do we offer all these options, but our true focus is on YOU."

Granting the vendor a choice of either (a) using your banquet of templates designed to ease their workload or (b) going through the tedious grind of negotiating back and forth on every item for months makes you and your templates the obvious and preferred choice every time.

In the oil and gas industry we manage JVs with a joint operating agreement. I'm not sure if that's helpful at all.

Hello Lamija, I have encountered this situation numerous times (in an industry other than the one I am in currently). My approach to this, usually with success, was to define a clause wherein the distributor is given a very clear revenue/sales goal for a defined period of time (say, 6 months to one year) during which we would not grant exclusivity, nor would we actively seek another distributor. If the distributor met the clearly defined objectives, we would then negotiate an exclusive arrangement. Many factors contribute to this scenario, however, such as the relative size of the market, the number (or lack) of distributors in the sector, the risk associated with "betting" on a single player, cultural social/considerations, etc.

In short, exclusivity based on proven performance. I hope that proves helpful.

In the US, Texas or New York are largely considered "neutral territory" whereas in Europe, until very recently UK law was considered neutral. I think that may change with the recent political upheaval.

Or try international trade law?

www.jus.uio.no/lm/index.html

In the case of one party proposing Indian law and the other proposing Singapore law, the parties may well choose the law of England and Wales as both Indian law and Singapore law are based upon English and Welsh common law. (Note that there is no such concept as "UK law" as one commentator has suggested below).

However, a party should consider a wide range of factors before proposing a particular governing law and should weigh up the legal and commercial advantages and disadvantages of all the options.

One factor may be the degree of certainty that a contract will be interpreted in a particular way. English law adheres to the doctrine of binding precedence. Some legal systems do not. This could lead to significant uncertainty as to how the law will be applied.

In English law, it may be perceived that the courts allow a greater degree of freedom of contract. Subject to certain exceptions, freedom of contract in English law means that commercial parties are completely free to make disastrous bargains. This illustrates the comparative reluctance of the English courts to interfere on policy or other grounds to rewrite the parties' contracts for them.

For example, in English law it is possible, provided very clear wording is used, to include an exclusion clause that excludes any and all liability whatsoever, even for a deliberate breach of contract. And there is still no recognition of a duty of good faith being applied generally to commercial agreements (but watch this space!). This may or may not be an advantage to you but it remains the case that the courts are likely to give effect to the wording of the contract without imposing their opinions as to what does or does not amount to good faith.


And you may wish to consider the approach of a particular legal system to particular clauses.

For example, in English law, a liquidated damages clause will be subject to the clarification set out recently by the Supreme Court with a subsequent judgment, applying that test, indicating that a freely-negotiated LD clause is likely to be upheld subject to the requirements set out by the Supreme Court. Under UAE law, such a provision would be subject to Article 390(2) of the Civil Code and either party may apply to the court to adjust the agreed amount of compensation so it is equal to the loss. If Indian law were to apply, we would have to consider the effect of section 74 of the Indian Contracts Act 1872.

English law will also recognise an asymmetric jurisdiction clause.

And it may be that the choice of law clause will be reflected in the choice of jurisdiction. So, English law and the English courts. If the choice of courts is to reflect the choice of law, it may well be the consideration should be given to the efficacy of the court system and the technical expertise and other qualities of the judges.

Lots to consider.