NDA, DPA, BAA, SLA and security addenda
Ancillary agreements carry no commercial terms. Keep them with the vendor for compliance and audits, and keep them out of spend.
Ancillary: No commercial terms. NDA, DPA, BAA, SLA.
Key takeaways
- Store them with the vendor they belong to.
- Never count them in spend.
- Check that each vendor that handles personal data has a data processing agreement.
Why keep them in the register at all?
Because audits and security reviews ask for them by vendor. A DPA in a shared drive is hard to find when a reviewer asks.
What to record
- Vendor
- Effective date
- Whether it is still current
Frequently asked questions
Do ancillary agreements expire?
Many follow the main agreement's term. Some, like NDAs, have their own.
General working knowledge about commercial contracts, not legal advice. Your own agreement governs.