For privacy counsel and data protection leads
Delete on instruction, produce what is held about one individual, hold nothing past its schedule, and tell us fast enough that our own clock still works. Each is answered here with a mechanism and a timeframe — including the one that is genuinely hard, which is deletion from backup copies inside the window most templates assume.
A processing agreement is unusual among contracts because signing it converts a supplier’s operational behaviour into your own warranty. If the supplier cannot actually delete on instruction, the failure is recorded against your organisation, and the supervisory correspondence arrives addressed to your accountable officer rather than to theirs.
Which is why the clauses that matter are the ones describing an action rather than a posture. Anybody will agree to process lawfully. The interesting question is whether a deletion instruction genuinely removes a record from every copy, whether an individual’s complete file can be assembled without a manual trawl, and whether the retention schedule is enforced by something or merely written down.
Backups are where nearly every template quietly breaks. A deletion instruction is drafted as absolute and immediate; backup copies are by design immutable for a retention window. Both are correct and they contradict each other, and the usual resolution is a clause nobody re-reads until an individual complains and the answer has to be written down.
Subject access is the request that looks trivial and is not. An individual asks what is held about them, and the honest answer spans the operating record, the correspondence, the notes somebody typed, the audit trail, and whatever a support interaction produced. Assembling that across a supplier’s architecture is either a designed capability or three weeks of somebody’s life, and the deadline does not care which.
And the clock is the clause with the sharpest edge. Your own notification obligation starts when you become aware. If a supplier tells you late, your window has already been consumed by their delay, and no drafting recovers the days. Counsel therefore reads the notification timeframe before nearly anything else, and treats a vague one as a decline.
A processing agreement is only as strong as the supplier’s ability to perform four specific actions on request — and the one that most often cannot be performed as drafted is deletion from backup copies within the window the template assumes.
Deletion on instruction removes the record from the operating store immediately and from derived stores — caches, search indexes, working copies — as part of the same action rather than as a follow-up somebody schedules. That much is straightforward and is the part every supplier describes.
Backups are the honest exception and it is stated plainly here rather than buried in a schedule. Backup copies are retained on a fixed cycle and a deletion instruction does not reach inside an existing backup image. What happens instead is that the record is not restored: the deletion is recorded, and any restore reapplies it before the data is served, so a restored copy does not resurrect a deleted individual. The record leaves the backup estate when the cycle ages out, on a stated schedule rather than an indefinite one. If your template requires deletion from all copies within days, that clause cannot be met as drafted and we will say so during redlining rather than sign it and hope.
Subject access is answered by assembly rather than by search. Everything held about one individual is retrievable through a single request — the operating record, the correspondence, anything typed by a person, and the audit trail of who touched it — because the records carry the individual as a first-class relationship rather than as a field somebody has to hunt for. That is what makes the deadline survivable.
Retention is enforced rather than documented. A schedule is configured per record category, records age out on that schedule without anybody performing a deletion, and the fact that they aged out appears in your log stream. A schedule that depends on somebody remembering is not a control, and most retention findings come from exactly that shape.
The notification commitment is stated as a number and is deliberately shorter than your own obligation, because a supplier’s window has to fit inside yours with room to act. What is committed is prompt notice on becoming aware of a personal data breach affecting your records, with what is known at that point rather than waiting for a complete picture — a complete picture arrives after your clock has run.
Deletion from the operating and derived stores — measured by issuing a deletion and confirming the record is absent from search and export afterwards.
Deletion durability across a restore — measured by a restore exercise in which a deleted individual does not reappear.
Time to assemble a complete subject file — measured by making one subject access request in a trial and timing the assembly.
Retention enforced without a person — measured by setting a short schedule in a trial and confirming records age out unaided.
Notification speed against your own obligation — measured by the committed timeframe written in the agreement, stated as a number of hours.
Evidence that a commitment was performed — measured by the event appearing in your own log stream rather than in a supplier report.
deletion does not reach inside an existing backup image and no template clause requiring that will be signed. No claim to determine your lawful basis, to act as controller, or to advise on your obligations. No privacy certification or seal is held or claimed, and an independent SOC 2 Type II attestation is in progress with no report in existence yet. Where a record must be retained by law, deletion is refused with the reason recorded rather than performed silently.
Every commitment above produces an event in your own log stream, which is what turns a contractual promise into evidence you hold rather than evidence you request. A privacy programme whose proof of performance lives entirely in a supplier’s systems has a weak position in front of an authority, and it is a weakness that only shows under examination.
Where records also exist in systems you operate, the deletion and retention instruction is yours to originate and ours to perform on our side — we do not reach into your estate to delete on our own initiative, and a supplier who would is a different and larger risk.
The processing record itself is exportable in a form your own documentation can consume, so the description of what is processed and why does not have to be maintained twice in two vocabularies that slowly disagree.
It is worth stating once more in the place counsel will read it: a deletion instruction does not reach inside a backup image that has already been written. Any supplier who signs a clause saying it does has agreed to something their storage does not do, and the discovery happens during an incident rather than during redlining.
What is offered instead is specific and checkable — deletion recorded and reapplied on restore, so a deleted individual does not return, and the copy leaving the estate on a stated cycle rather than an indefinite one. If that is not sufficient for your obligation, it is a decline, and one made in week one rather than after four rounds of redlines.
No privacy certification, seal or approved code of conduct is held or claimed on our own account. The lawful basis for processing is yours to determine as controller; nothing here supplies one, and a supplier implying that their status provides your basis has described something that does not work that way.
On independent assurance, a SOC 2 Type II attestation is in progress and no report exists yet, so nobody can be handed one. It is an attestation with a defined scope and period rather than a certification. Where a clause requires an existing report as a condition, that condition is not currently satisfiable and saying so early is cheaper for both parties.
Redline the deletion clause first and specifically against backups, because that is where the impossibility lives. A supplier who accepts an absolute deletion clause without qualifying backups has told you they did not read it or cannot perform it, and either answer is useful this early.
Fix the notification timeframe as a number of hours rather than a promptness adjective, and make it comfortably shorter than your own obligation. Days consumed by a supplier’s internal review are days your organisation does not have, and no amount of drafting recovers them afterwards.
Test subject access rather than accepting the clause. One request in a trial environment, timed. A supplier whose answer requires engineering effort will produce a subject file eventually and not within a statutory deadline, and the gap is invisible in a contract.
And set a deliberately short retention schedule in the trial and watch whether records actually age out. Retention is the commitment most often documented and least often enforced, and it is the one an authority tends to sample.
A redline pass over your own processing agreement template, answering each clause with a mechanism or a decline, before any commercial discussion begins.
The correct first artefact is your template with our answers written against it, including the declines. A supplier who returns it with no declines has either an unusual architecture or has not read it, and the second is far more common.
Where a clause cannot be met, the useful outcome is knowing in week one. A privacy team that discovers an operational impossibility in the final week of a procurement has lost the leverage to do anything except accept it or restart.
Only after that pass does a trial make sense, and the trial should exercise the four commitments rather than the features — one deletion, one subject access, one short retention schedule, and a look at where each event landed.
That clause cannot be met as drafted and we will not sign it. A deletion instruction does not reach inside a backup image that has already been written — no supplier’s does, and one who agrees has committed to something their storage will not perform. What is offered instead is that the deletion is recorded and reapplied before any restore serves data, so a deleted individual does not reappear, and the copy leaves the estate when its cycle ages out on a stated schedule. If that is insufficient for your obligation, this is a decline, and you are hearing it now rather than in the fourth redline round.
The commitment goes in the agreement as a number of hours rather than as a promptness adjective, and it is deliberately shorter than your own obligation so your window is not consumed before you know. What is committed is notice with what is known at that point, not a complete picture — a complete picture arrives after your clock has run, and a supplier who waits for one has spent your days on their internal review. Hold every supplier to a number here; the vague version is the tell.
Through one request, because records carry the individual as a first-class relationship rather than as a field somebody has to search for. That covers the operating record, the correspondence, anything a person typed, and the audit trail of who touched it. Test it rather than accept it — make one request in a trial and time the assembly. A supplier for whom this is an engineering task will produce a file eventually and not inside a statutory deadline, and that gap is completely invisible in the contract language.
You are the controller for the records you place here and we process on your documented instruction. Nothing about our status supplies your lawful basis, and any supplier implying that their certification or posture provides one has described something that does not work that way. What we do not do is act on our own initiative with your records — we do not delete inside your own estate, and we do not process for our own purposes, which is a separate commitment and belongs in the agreement in writing.
No privacy certification, seal or approved code of conduct is held or claimed. The independent work under way is a SOC 2 Type II attestation, no report exists yet, and it is an attestation with a scope and a period rather than a certification — different instruments, and the second word is routinely used to imply the first. Where your template makes an existing report a condition of signature, that condition is not currently satisfiable, and it is better established before commercial terms than after them.