How to include GDPR clauses in a contract?

Short answer

1. 1Access 4mycontracts.net and select the desired contract type.
2. 2Choose the template with pre-filled GDPR clauses compliant with current law.
3. 3Enter the data controller details and categories of data subjects.
4. 4Define the purpose, legal basis, and retention period for personal data.
5. 5Sign electronically and store the contract in the secure archive.

What the law says

• GDPR (EU Regulation 2016/679) — mandatory legal basis for any personal data processing clause.
• Romanian Law 190/2018 — national GDPR transposition, applicable to employment and client contracts.
• GDPR Art. 28 — Data Processing Agreement (DPA) mandatory between controller and processor.
• GDPR Art. 13-14 — obligation to inform data subjects, including through contractual clauses.
• Civil Code Art. 1270 — binding force of contracts, including GDPR confidentiality clauses.

Practical examples

• IT services contract with DPA clause per GDPR Art. 28 (access to client databases).
• Employment contract with GDPR annex for staff accessing customer personal data.
• Digital marketing contract with external agency — data processing and international transfer clause.
• Extended NDA with GDPR clauses for SaaS partner processing end-user data.

Common mistakes

• Failing to identify the legal basis (consent, contract, legitimate interest) in the GDPR clause.
• Generic data processing clause copied without specifying exact categories of data processed.
• Missing clause on data subject rights (access, rectification, erasure, portability).
• Omitting data retention period and deletion procedure upon contract expiry.

How 4mycontracts helps

• GDPR clause templates automatically updated with legislative changes, no manual intervention needed.
• Predefined fields for legal basis, data categories, and retention period — critical sections cannot be skipped.
• Secure archive with version history — proves GDPR compliance during regulatory audits.
• Integrated qualified electronic signature — full legal validity without printing or travel.
• Standalone DPA export (Art. 28) directly from the contract, ready to send to subprocessors.