How to verify if a contract is GDPR-compliant?

Short answer

1. 1Go to 4mycontracts.net and open the contract or template to review.
2. 2Identify the personal data processing clauses in the contract.
3. 3Verify that each data category has a valid legal basis (consent, legitimate interest, etc.).
4. 4Confirm clauses covering data subject rights (access, erasure, portability) are present.
5. 5Note the gaps and add the missing clauses before signing.

What the law says

• EU Regulation 679/2016 (GDPR) — mandatory legal basis for any personal data processing.
• Art. 13-14 GDPR — obligation to inform the data subject within the contract.
• Art. 28 GDPR — processor agreements must include specific DPA clauses.
• Romanian Law 190/2018 — national GDPR implementation, applicable sanctions.
• Art. 83 GDPR — fines up to EUR 20 million for non-compliance.

Practical examples

• B2B SaaS contract with integrated DPA clauses for end-customer data processing.
• Employment contract for staff accessing company client personal data.
• Cloud service provider agreement for personal data stored within the EU.
• NDA with an external freelancer granted access to a user database.

Common mistakes

• Missing DPA clause in software vendor contracts — a direct GDPR violation.
• Legal basis for data processing not explicitly stated anywhere in the contract.
• No breach notification procedure specified (GDPR requires 72-hour reporting).
• Data retention clause absent or vague, lacking a specific timeframe.

How 4mycontracts helps

• Contract templates to which you add the GDPR clauses that fit your situation.
• Fields to fill in for purpose, legal basis and duration, which help you avoid omitting sections.
• Block-level negotiation with version comparison between drafts.
• Archive in your account, with the event history of each contract.
• Simple electronic signature through a secure link — the signer needs no account.