How to review a data security clause

A data security clause sets what a vendor must do to protect the data it handles and what happens when something goes wrong. It sits in MSAs, SaaS agreements and data processing addenda. This guide covers the US rules behind these clauses, a checklist of points to check and how to review one in Word with LexDraft.

Last checked: 18 October 2026. The law changes; check the current position before relying on this page.

The rules behind the clause

• State breach notification laws. All 50 states, the District of Columbia and several territories have laws requiring notice to individuals after certain security breaches. Definitions, deadlines and regulator notices differ by state, so the contract should say who notifies and who pays.
• Contractual security duties. California Civil Code section 1798.81.5(c) requires a business that discloses personal information about California residents to a nonaffiliated third party under a contract to require by contract that the third party implement and maintain reasonable security procedures and practices.
• Sector rules. Health data handled for a HIPAA covered entity needs a business associate agreement. See our BAA review guide. Other sectors, such as financial services, have their own rules.
• Personal data from the UK or EU. A data processing addendum usually carries the processor terms required by the GDPR or UK GDPR. See our DPA review guide.

Clause checklist

• Security standard. "Reasonable" or "industry standard" security, or a specific schedule of measures? A schedule is easier to enforce. Check any certification or audit report named, such as ISO 27001 or a SOC 2 report.
• Key measures. Encryption in transit and at rest, access controls, multi-factor authentication, logging, vulnerability management and staff training.
• Incident notice. A defined "security incident", notice within a fixed number of hours or days after discovery, the information to be provided and ongoing updates.
• Cooperation and costs. Who investigates, who notifies individuals and regulators, and who pays for notices, call centers and credit monitoring.
• Subprocessors. A list, flow-down of the same security duties, notice of changes and a right to object.
• Audits. Reports, questionnaires, penetration test summaries and on-site audit rights, with limits on frequency and cost.
• Return and deletion. Return or deletion of data at the end of the contract, within a set period, with certification on request.
• Liability. Whether data breach losses sit inside the general cap, under a separate higher cap or uncapped. See our limitation of liability guide.
• Insurance. Cyber insurance limits that match the risk and the liability cap.

A data security clause review workflow in Word

LexDraft is a Word add-in from Microsoft AppSource. It opens as a side panel in Word 365 (Windows and Mac), Word 2021 and Word on the web, so the agreement never leaves the tool you already draft in.

1. Open the agreement in Word and open LexDraft in the side panel.
2. Pick the governing law. Select the state named in the governing law clause so LexDraft looks for state-specific red flags.
3. Run the review. If the security terms sit in a data processing addendum, run the DPA playbook, one of four built-in playbooks alongside NDA, SaaS MSA and services agreement; for a SaaS agreement use the SaaS MSA playbook. Security terms in other contracts run as a general AI review against the governing law you chose. LexDraft has no separate clause-only playbook.
4. Triage by severity. Findings are graded Critical, High, Medium or Low, and LexDraft flags standard terms that are missing.
5. Run the quick checks. The defined-term and cross-reference checks are rule-based and run without AI.
6. Accept or reject each redline. Accepted changes land as native Word tracked changes.
7. Verify and sign off. You check every output before it goes to the client or the other side.

What LexDraft does not do

LexDraft does not give legal advice, assess a vendor's actual security or tell you which breach laws apply to an incident. Nothing changes in your document until you accept a redline.

This guide is general information, not legal advice. LexDraft does not give legal advice; qualified counsel must review every draft. Spotted something out of date? Email support@lexdraft.ai and we will fix it.