Eight marketing automation contract issues, from processing instructions to exit

Marketing automation commercial contracts need more than a data-processing addendum. The agreement should name the service, the processing roles, the testable security controls, the change notice and the export format at exit. A named administrator or integration user role restricts what a person can do inside the product; it does not create or remove a contractual duty.

This non-ranked list was compiled on 5 September 2026 for organisations contracting from England. Inclusion required a direct connection to UK data-processing duties or the operation of a cloud marketing service.

The ICO's controller and processor contract guidance is the main regulatory record. Platforms such as HubSpot, Mailchimp and Salesforce Marketing Cloud publish their own data-processing terms, which are the starting point rather than the finish.

A named English commercial-contracts lawyer, UK data-protection lawyer and qualified security reviewer must examine the final article and any real agreement.

What to take away

A marketing automation contract needs more than a data-processing addendum to cover service, security, change and exit.
The ICO contract guidance is under review and does not cover commercial negotiation, so legal review is required.
Transfer analysis must consider UK GDPR applicability, customer initiation and recipient legal status, not just server location.
Termination planning should cover export format, timing, assistance, account closure, backups and deletion evidence.

1. Processing scope and instructions

Identify the subject matter, duration, purpose, types of personal information and affected people. The same schedule should say whose documented instructions the processor follows. Check each optional feature because a supplier may act in a different role for separate uses.

Spell the data out in the product's own terms: email address, phone number, IP address, campaign interaction history, consent status and retention period. Name the person who sends instructions, usually the client's data protection lead, and flag any add-on, such as a messaging tool, where the supplier's role may change.

2. Confidentiality and access

Define who may access customer data and under what controls. Contract promises should match the product's real administrator, integration and support roles. The NCSC cloud security principles cover secure user management, identity, administration and audit information, but they are evaluation guidance rather than proof that a service meets a customer's needs.

List the roles the product actually creates: account administrator, marketing user, integration user and supplier support engineer. Record whether support access is time-limited, whether it needs customer approval and whether each session is logged.

3. Security evidence and incidents

Specify the security information the supplier must provide, how material changes are reported and what incident assistance is required. The ICO contract guidance includes appropriate security and assistance among the minimum processor topics. Commercial counsel should make notification routes and response obligations precise enough to operate.

Ask for the current SOC 2 Type II report or ISO/IEC 27001 certificate, its scope statement and the date of the latest penetration test summary. The customer's own deadline to notify the ICO is 72 hours from awareness, so the supplier's notification window has to sit inside it.

4. Subprocessors

Record the authorisation mechanism, notice period, objection route and flow-down obligations. A public subprocessor page is useful only if the contract says what happens when that list changes. Verify which legal entity provides each relevant function.

Supplier terms often set a subprocessor notice period of 10 to 30 days. The signed order is the authority, and the window has to be long enough to review the entity before the next campaign. Ask which entity hosts the data, which sends the email and which provides analytics, because one list entry can cover several functions.

5. Overseas access and transfers

Do not reduce transfer analysis to server location. The ICO's January 2026 international-transfer guide asks whether UK GDPR applies, whether the customer initiates a transfer outside the UK and whether the recipient is a separate legal entity. Contract schedules should reflect the reviewed route and applicable mechanism.

A support engineer opening a customer record from another country raises the same question as a data centre in another region. Record the hosting region shown in the product settings and the entity that signs the data terms.

6. Service, change and suspension

Describe the purchased functions, usage limits, support, dependencies and the supplier's ability to alter or withdraw them. Decide what notice or remedy is needed if a change breaks a suppression rule, audit trail or required permission boundary. These are commercial questions for counsel, not outcomes supplied by the ICO guidance.

If a release removes a suppression rule or an audit log export, the contract needs a notice period long enough to test the change and a remedy if the test fails.

7. Audit, evidence and platform permissions

The agreement should make legally required information and audit support available. Separately, document who can import data, export it, change a journey or grant credentials. Test those controls. Neither a contractual audit clause nor a role name proves the technical configuration works.

Name the roles that hold import and export rights, such as admin, integration user and journey editor, and log every export with the user, the timestamp and the record count.

8. Termination, return and deletion

Plan export format, timing, assistance, account closure, backups and evidence of return or deletion. The ICO's processor guidance lists end-of-contract provisions among required areas. The commercial terms should also address transition support and loss of access, subject to tailored legal advice.

Ask for CSV for contacts and suppression lists, JSON for journey and automation definitions, and a dated certificate of deletion. Fix the final export window and the cut-off date for live journeys.

Publication and procurement gate

On publication day, recheck the ICO's under-review notice, its guidance plan and the NCSC page version. A buyer should also compare the current signed order, data terms and product configuration. If a material term is missing or conflicts with the intended workflow, pause procurement and send the actual documents to the named reviewers.

Before you act

Procurement lead, two weeks before signatureconfirm the schedule names every data type, the retention period and the instruction contact.
Marketing operations owner, before go-livemap the admin, integration user and support engineer roles to the live permission settings and record the test date.
Security reviewer, during contractingobtain the SOC 2 Type II report or ISO/IEC 27001 certificate, note its scope and the penetration test date.
Data protection lead, on each subprocessor noticecheck the notice period and objection route in the signed terms before the window closes.
Contract owner, one month before the end daterequest the CSV and JSON exports, the final export window and the deletion certificate date.

Common questions

What should a marketing automation contract cover beyond a data-processing addendum?

Service scope, processing roles, testable security controls, change notice, export format and deletion evidence. A standard data-processing addendum rarely settles those points.

How should overseas access and transfers be analysed in the contract?

What should a buyer do if a material term is missing or conflicts with the intended workflow?

Pause procurement and keep the signed order, the data terms and the product configuration together in one file. Your legal and security reviewers need the actual documents, not a summary of them.