I do not think there are any legal roadblock to do so, if the parties agree to make the amendment that should be it.

what you need to add to the master agreement are clauses derived from Art. 28. I am also doing the same for my Master Agreements. Here is an example,
Obligations of processors (supplier) in particular include:
- To comply with the GDPR data processing principles and to protect the rights and freedoms of data subjects;
- To demonstrate compliance with the GDPR;
- To maintain records of processing activities and make them available upon request by supervisory authorities;
- To appoint data protection officers or representatives;
- To cooperate with supervisory authorities in the performance of their tasks;
- To ensure a level of security by taking appropriate technical and organisational measures;
- Specific obligations as regards transfer of data outside the EU.
In general, an auditor (DPA) should be able to trace data regarding customers. This also include emails, Excel spreadsheets with links to external systems such as financial and banking, etc.
It is not enough to have a supplier follow the GDPR. It is of most importance that your company/organisation is also GDPR compliant. To start with you need to have a DPO.

As mentioned by Amir there are a number of elements to include, and depending on your organisation and the data you are processing you may need to identify a DPO.

Other things you should identify include:

Is the relationship with the supplier a Controller-Processor, Processor-Sub Processor or Controller-Controller.
Is special data being transferred to the supplier?
Will the supplier be exporting data outside of he EU?

You may also want to include an indemnity clause in case the supplier causes you to breach the GDPR regulation.


If you go to the Information Commissionaire's Office website in the UK (ICO.org.uk) there are some excellent guides and information which may assist you (including links to Article 29 Working Party).

Regards

Carl

Hi, this is not something to answer without knowing more details. Interesting to know is who is the data processor and who the data controller? What kind of data flows will there be? How sensitive is the personal data involved in this.. etc etc.. You may want to look at the liability limits...

Hi,
The question is what this deal is all about. There will be a different approach to just shipping some goods vs. complicated outsourcing contract which you process personall data for. Remember that you need to remeber that even contact details stated in the agreement for e.g. contract managers are considered to be under GDPR scope. What my concern is, you very likely act as processor for your customer. The buyer's organization is the Administrator. Did they raise any particular matter.
It looks like you are outside of Europe. GDPR is not only about the DPA to stay compliant. You as a processor have certain duties to fulfill. If your company is not on Privacy Shield list (which in fact may soon become invalid just as Safe Harbour) according to some media news, it could be better to have Standard Contractual Clauses in place.
The topic is very broad and without more details it is difficult to help you.
Regards,
Piotr

IACCM conducted a Ask The Expert webinar on this topic, featuring James Mullock of Bird and Bird. His session was highly rated. The recording and James's presentation are in the IACCM Library. Plus, there are a few other resources in the IACCM Library which are relevant. If you have trouble finding these resources, please let me know.

Best Regards,

Jim Bergman
IACCM

You can also have a look at the Article 29 Working Party webpage - there is a page setting out draft contract provisions that are in line with the GDPR as it is currently being interpreted. You may not want to use the clauses themselves but can use them as a measure for your own inclusions.

Hi,
Happy to provide some information on software that can help you quickly and efficiently overcome this cumbersome challenge.

Depending on the nature of the agreements and the industry, there are likely to be ways that IACCM can assist you with appropriate sources of review. Please get in touch with further details. My email is tcummins@iaccm.com

I would love to hear about the software discussed below, conflicts of custom get too little attention

Thanks Jessica for posting this question. I appreciate all the inputs from everyone most especially Jason's reply. Like many others, suggesting to our vendors the use of our company templates for professional services is always a challenge. But as Jason suggested, explaining the benefits of using the company template (e.g. easy approval of subsequent statements of work once an MSA has been approved) makes the vendor think and eventually agree. Of course, there is negotiation in the process. It is not a straightforward demand of asking them to accept the template per se but making them aware of the benefits does help.

Since this discussion started almost 2 years ago, the world of technology has progressed and IACCM can today offer a service to validate 'contract norms'.

A challenge for buyers and suppliers is that their templates start from positions of self interest and naturally this creates contention and delay. It is now quick and relatively easy for us to provide members with insight to what is a normal position / term for any particular type of. Ontract. This allows internal discussion of the desirable business position and of course informs external discussion to accelerate agreement.

Even though it has been a long time since Jessica posted this, I would like to add my comment (may be somebody is still interested in this topic). Usually, I don't face problems with internal clients in the way they don't want to share the template with our customers. On the other hand of course, customers sometimes come back with their template (instead of any comments/tracked changes in our template) or, if not such a "strong" company to insist on their template, they send our template back with all important clauses deleted and replaced with their template wording. Sometimes it is just a matter of wording, and when I see the content is the same and can imagine how long would it take them to have our wording reviewed and approved, I agree with theirs instead. However, sometimes it is really a totally different story, setting us in such an unpleasant situation, that the best option would be not to sign the contract at all. What I learned is, that is not only a question of the size of a company or its hierarchy (=how many approvals do they need), it is often also a "cultural" thing. Some nations have negotiations or even fighting for a win in their veins, and they push back just as a matter of principle. When you set up relevant points in front of them, they usually agree and you get their respect. A great distinguishing model here is the one of Hofstede, which was also mentioned in one of the modules.
Coming back to Jessica's comment, I sometimes face a different problem - internal clients wish to send the template immediately to the customer without any prior discussions or involvements of Contracts. They simply tend to find somewhere a blank template and go out. I always need to explain, that Contracts need to see it and that we, Contracts, are the one responsible for it. Even though using a template, every single deal is unique and a template needs to be adjusted not only with regards to the deal's specific, but also based on our experience with the customer (e.g. I know Czech companies insist on having their ID and information about incorporation in the legal name and address description - if I wouldn't place it in the contract prior sending to the customer, we would look stupid and like we don't care about customer's needs at all. the same is with Russian customers, who, due to their law requirements, need to have bank details explicitly written in the agreement - so I won't release any draft for their review without inserting those bank details).
So I think nobody can only focus on one side of the business - I believe it is not only about customers (CRM) but about relationship with the internal clients (trusted advisor) as well.

Hi Jessica
This is a common problem. Many of the relationships with indirect
suppliers are less formal and may have been in place for years, leading to resistance over use of standard templates.

It is of course important to establish whether the issue is just general resistance or whether the standards are not really appropriate to the range of indirect relationships required, or lack required flexibility.

We do have benchmark data at IACCM on cycle times and will be issuing reports on the latest information at the end of April. It should be possible to provide interim data if you need it sooner.

Tim

Internal Template application rather than the one of the supplier is usually a requirement nevertheless the real issue behind is do we protect ourself correctly. Legal usually is validating a template that he wants verybody contract manager to apply. As legal ressources are scarce and expensive ressources it is ovious that this is the first thing that should be pushed. Once you know that he does not work the more complex but more interesting solution for the company is to look at the mandatory clauses that are requested from the contract. So instead of pushing your template you should fight on the mandatory clauses. Fall back position should be created as a handbook of best practices.

Ms. Prendergast,

Templates, while easy to copy and work with, present a challenge to many companies in part because the template is usually written from one side or the other, providing all the advantages to the author's side and none to the recipient. This is frequently seen in EULAs, where the equivalent of "Not only do we have all the rights, but you are lucky we let you use our product at all, you horrible little vendor!" is common contract parlance.

So how do you overcome the natural inclination of a vendor to resist your templates? The same way you advertise anything else!

Make the option of using your product (the templates) both appealing and advantageous to the vendor. When sending internal templates to a vendor for use, do not present them as a "use or lose" option. Instead, deliver the items with the contracting equivalent of a box of chocolates: Provide vendors a summarized explanation of the benefits offered through using your templates. Bullet-oriented briefs are more effective here, as they provide not only a quick list for the vendor to read, but a point-summary for the vendor's contract manager to use in presenting the overwhelming benefits offered by your templates to their management.

Explain (again in short form) the potential realized cost savings of template use, including ease of follow-on contract development by way of utilizing your "easily-tailored, customer-specific templates." Make every effort to ensure using your templates is so much easier than having the vendor's contract department reinvent the procurement wheel that the vendor (who at this point you should view as your customer) would actually be acting against their own best interest to do anything other than to use your templates.

As M. Fouquier rightly points out, the usual greatest challenge is getting your templates past the legal department guardians. Providing a brief mandatory clause list may be a more advantageous initial step, as it tends to ease legal's protective instinct toward its client(s). Once you present not merely a palatable offering of clauses, but a tasty array of work-easing options to the vendor (and the vendor's legal counsel), your job is 90% done. Offering updates and non-critical individual tailoring options (which would not, of course, change the mandatory clauses) gives the vendor the personalized attention so critical to obtaining their final approval. It is the after-dinner apertif of contracting: "Not only do we offer all these options, but our true focus is on YOU."

Granting the vendor a choice of either (a) using your banquet of templates designed to ease their workload or (b) going through the tedious grind of negotiating back and forth on every item for months makes you and your templates the obvious and preferred choice every time.

It would seem logical to have one interface and have other entity operate as a sub-contractor. Failing that, make the implementation partner accountable for operational performance.

Thank you Anonymous.

Hi Jason - typically the RFInformation precedes the RFProposal as a way of assessing market solutions and capabilities. The RFI may get a sense of 'ballpark' pricing but typically it focuses on solution features not pricing. The RFI also helps to refine the customers requirements by discovering what and who is 'out there'. This helps to develop a tighter RFP which seeks the best solution fit, commercial fit (including pricing and contract variations), and cultural or strategic fit.The 'sourcing' process of RFI, RFP, BAFO etc. is well covered in our CCM/Practitioner training at www.iaccm.com/training/contract-management/

Hi Bruce,

Many thanks for your response, I appreciate it.

The organisation decided to go with some sort of hybrid model of an RFI and RFP. Simply, put the organisation is assessing a particular solution, however, they are also assessing the technical compliance of the solution as the same time and scoring respondents/tenderer's on that aspect. Also, that score will be used later when the "RFP" process starts. Personally, this process does not sit well with me. Is this common practice or a recipe for a disaster?

Regards,
J

Hi Jason,
I'd echo Bruce's point regarding separate RFI and RFP processes. Whilst a combined approach may initially seem efficient it more often than not can lead to confusion from the supply chain as to what is being required and also by the organisation as to what the market can offer, suppliers may also view the client as dis-organised with no clear directive and they may not wish to collaborate. In addition some suppliers may view a combined process as an attempt to unfairly benchmark ahead of any official RFP process. Although not a guaranteed "recipe for disaster" trying to join the two processes together requires close and careful management.

Regards
R.

Dear Richard,

Many thanks for your response! Valuable input.

Regards,
Jason

Ignoring good procurement advice can lead to big problems - see recent Covid-19 related example at www.linkedin.com/feed/update/urn:li:activity:6704961540061323264/

With regard to technology, Docusign and others have fairly secure systems in place to ensure the integrity of e-signature contracts. Some organisations, however, still try to arrange in person signings where possible. In these circumstances, though, you will need to ensure that all signed contracts are stored safely and in a searchable repository as finding signed contracts remains a perennial problem for many who do not have comprehensive document repositories deployed.
With regard to your second question, many organisations have their legal functions handle the contract signature process. The larger the organisation, however, the more impractical such a set up can often be, as there are just not enough resources. Many organisations still have the sales function handling the signature process. There should be strict guidelines and processes in place to help ensure integrity and to prevent mistakes such as wrong versions being signed etc.

Hi Lisa, the organisation I work for has several long term contracts with the Australian Department of Defence. Some of these contracts include the use of scorecards, which are taken very seriously by both parties. These are followed to the letter and form part of our PBC's.

Hi Lisa - look, I'll give this a go. And these are my personal views and experiences.

Mission critical parts to us would mean that it would likely be called a Significant Service Contract here in New Zealand. Right now, with a greater focus on broader / social outcomes in place across many organisations, internal culture might indeed get a rating, or be evident in measures about environmental outputs, staff training or recruitment.

That said, you'd expect for mission critical parts that the greatest weighting would be their ability to deliver, and depending on the total weightings, it's probably likely that a company that can show this better, even with a lesser internal culture, would be likely to end up chosen in a supplier relationship.

Yes, at least to the extent that 'culture' reflects underlying honesty and integrity. If something is mission critical, it is essential that the supplier is reliable. It is also important that they do not represent a reputational risk, especially if transfer to an alternative supplier would be difficult or take time to achieve.