As part of the conference “ICT Outsourcing Contracts”, organised by Paradigma, Alessandro Del Ninno, Attorney-at-Law and Partner at FIVERS Law and Tax Firm, delivered a presentation entitled “Data Protection Clauses”, focusing on the legal and contractual aspects of data protection and data management in ICT outsourcing arrangements.

The presentation examined the evolving European regulatory framework governing data, with particular emphasis on the interaction between the General Data Protection Regulation (GDPR), the Data Act, the Data Governance Act (DGA) and the AI Act, within the broader context of the European Data Strategy and the development of the data-driven economy.

Particular attention was devoted to the distinction between personal and non-personal data and its implications for the structure and content of ICT agreements, as well as the legal qualification of the different parties involved in data processing activities and digital service provision. The session explored the roles of data controllers, processors and joint controllers, the responsibilities of service providers and users, and the contractual consequences of an inappropriate allocation of obligations.

A specific focus concerned the essential provisions of data processing agreements, including legal bases for processing, transparency obligations, subcontracting arrangements and the management of contractual chains. The presentation also addressed the main risks associated with personal data breaches, improper use of information and unauthorised data transfers, together with contractual safeguards such as audit rights, termination clauses and compensation mechanisms.

Further analysis examined contractual provisions governing data access and sharing, highlighting the need to balance opportunities for data exploitation and circulation with the protection of know-how and corporate information assets. Additional attention was devoted to the contractual implications of the Data Governance Act, the role of businesses acting as data intermediaries and the transparency and neutrality requirements applicable to data intermediation services.

The presentation provided a practical legal overview of the principal challenges associated with data protection provisions in ICT outsourcing contracts, with the aim of equipping businesses and professionals with effective tools to negotiate balanced agreements, properly allocate responsibilities between contracting parties and ensure regulatory compliance in the management, access and sharing of data across digital supply chains.