How to include GDPR clauses in a contract?

Short answer

1. 1Access 4mycontracts.net and select the desired contract type.
2. 2Choose the template and add the GDPR clauses that fit your situation.
3. 3Enter the data controller details and categories of data subjects.
4. 4Define the purpose, legal basis, and retention period for personal data.
5. 5Send for electronic signature through a link and archive the contract in your account.

What the law says

• GDPR (EU Regulation 2016/679) — mandatory legal basis for any personal data processing clause.
• Romanian Law 190/2018 — national GDPR transposition, applicable to employment and client contracts.
• GDPR Art. 28 — Data Processing Agreement (DPA) mandatory between controller and processor.
• GDPR Art. 13-14 — obligation to inform data subjects, including through contractual clauses.
• Civil Code Art. 1270 — binding force of contracts, including GDPR confidentiality clauses.

Practical examples

• IT services contract with DPA clause per GDPR Art. 28 (access to client databases).
• Employment contract with GDPR annex for staff accessing customer personal data.
• Digital marketing contract with external agency — data processing and international transfer clause.
• Extended NDA with GDPR clauses for SaaS partner processing end-user data.

Common mistakes

• Failing to identify the legal basis (consent, contract, legitimate interest) in the GDPR clause.
• Generic data processing clause copied without specifying exact categories of data processed.
• Missing clause on data subject rights (access, rectification, erasure, portability).
• Omitting data retention period and deletion procedure upon contract expiry.

How 4mycontracts helps

• Contract templates in which you add the GDPR clauses that fit each party’s role.
• Fields to fill in for purpose, legal basis, data categories and duration, so you do not skip critical sections.
• Archive in your account, with the event history of each contract.
• Simple electronic signature through a secure link — the signer needs no account.
• The DPA is concluded as a separate document or an annex, signed through the same flow.