Can this addendum be signed electronically?

Yes. Electronic signatures are legally effective under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted; ensure consumer-facing disclosures where required and preserve a reproducible record.

Is a Business Associate Agreement required?

If the addendum covers protected health information, a BAA is required to meet HIPAA obligations and should be appended to or incorporated into the Legal Data Addendum.

When is notarization or witnessing necessary?

Most contract addenda do not require notarization, but state law or specific transaction types (real estate, certain powers) may require notarization or witnesses; check local rules.

How can a party revoke or amend the addendum?

Amendments require mutual written agreement as specified in the amendment clause; unilateral revocation is only effective if the agreement permits it or by mutual consent.

How long must parties retain the executed addendum?

Follow the retention schedule in the addendum; federal minima include IRS records (IRC §6501(a)) and HIPAA records (45 CFR §164.530(j)), with state-specific extensions possible.

Who is authorized to sign the addendum?

An authorized officer or individual with contracting authority must sign. Verify delegated authority in corporate records to avoid later challenges to enforceability.

Electronic Signature
Templates
Legal
Legal Data Addendum

Legal Data Addendum

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

LEGAL DATA ADDENDUM

This Legal Data Addendum (the Addendum) is entered into as of by and between Controller: with principal place of business at , and Processor: with principal place of business at . Controller and Processor are each a Party and collectively the Parties.

RECITALS

WHEREAS, Controller has lawful authority to determine the purposes and means of processing certain categories of personal or regulated data and desires to engage Processor to process such data on Controller's behalf; and

WHEREAS, Processor will process data for Controller in connection with the Services described in the underlying agreement between the Parties and will implement administrative, technical and physical safeguards to protect such data; and

WHEREAS, the Parties desire to set forth their respective obligations with respect to the categories of data, permitted purposes, retention, security, subcontracting and audit rights.

NOW, THEREFORE, in consideration of the mutual covenants contained herein, the Parties agree as follows:

1. DEFINITIONS

1.1. "Personal Data" means any information relating to an identified or identifiable natural person provided by or collected on behalf of Controller and processed by Processor pursuant to this Addendum. "Services" means the activities performed by Processor for Controller under the underlying agreement. Capitalized terms used but not defined in this Addendum have the meanings given to them in the underlying agreement.

2. DESCRIPTION OF DATA AND PROCESSING

Categories of Data

Indicate categories of Personal Data to be processed (check all that apply):

Personally Identifiable Information (names, identifiers)

Financial or Payment Data

Health or Medical Data

Other (specify):

Purpose of Processing Detailed Description of Processing Activities

3. DATA SECURITY AND CONTROLS

3.1. Processor shall implement and maintain administrative, technical and physical safeguards appropriate to the risk, including but not limited to encryption in transit and at rest, reasonable access controls, logging and monitoring, incident response procedures and least-privilege access. Processor shall ensure that such safeguards meet or exceed industry standards for the type of data processed.

Specific Security Measures Implemented by Processor

3.2. Processor will notify Controller without undue delay upon becoming aware of any Security Incident affecting Controller Personal Data. Notification shall include a description of the nature of the incident, the categories of data affected, the mitigation measures undertaken and any remediation plan reasonably expected to prevent recurrence.

4. SUBPROCESSORS

4.1. Controller hereby authorizes Processor to engage Subprocessors to perform specific processing activities, provided that Processor (a) imposes on each Subprocessor obligations no less protective than those in this Addendum; (b) remains liable for the Subprocessor's performance of its obligations; and (c) provides Controller with prior written notice of new Subprocessors and the opportunity to object on reasonable grounds relating to data protection.

4.2. Processor shall maintain a current list of Subprocessors and, upon Controller's reasonable request, shall provide details of Subprocessor locations, services and safeguards.

5. DATA SUBJECT RIGHTS AND COOPERATION

Processor shall, taking into account the nature of the processing, assist Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of Controller's obligations to respond to requests from data subjects to exercise their rights under applicable law. Processor shall promptly notify Controller if it receives a data subject request relating to Controller Personal Data and shall not respond to such request except on Controller's documented instructions or as required by law.

6. RETENTION, RETURN AND DESTRUCTION

Upon expiration or termination of the underlying agreement, Processor shall, at Controller's choice, return all Personal Data in a commonly used machine-readable format and delete existing copies, or securely destroy such data. Notwithstanding the foregoing, Processor may retain such data to the extent required by applicable law, provided Processor isolates and protects the retained data and notifies Controller of the legal requirement.

Retention Period

7. AUDIT AND COMPLIANCE

Controller has the right to audit Processor's compliance with this Addendum, including inspection of Processor facilities and review of relevant records, subject to reasonable advance notice, confidentiality protections and limitations to minimize disruption. Processor shall provide reasonable cooperation and access to records, personnel and systems necessary to demonstrate compliance.

8. CONFIDENTIALITY

Processor shall treat Personal Data as Confidential Information and shall not disclose such data except as necessary to perform the Services or as required by law. Processor shall ensure that personnel with access to Personal Data are subject to confidentiality obligations.

9. LIABILITY AND INDEMNIFICATION

Each Party's liability for breaches of this Addendum shall be governed by the liability provisions in the underlying agreement. Processor shall indemnify and hold harmless Controller from third-party claims arising from Processor's negligent or willful failure to comply with this Addendum, subject to the limitations of liability set forth in the underlying agreement.

10. TERM AND TERMINATION

This Addendum shall commence on the Effective Date and shall continue for the term of the underlying agreement or until all Personal Data has been returned or destroyed in accordance with Section 6. Termination of this Addendum shall not relieve Processor of its obligations with respect to Personal Data processed prior to termination.

11. NOTICES

Any notice required under this Addendum shall be in writing and delivered to the address for the relevant Party set forth below or to another address a Party designates by notice in accordance with this Section.

Controller Notice Address Processor Notice Address

12. AMENDMENTS, WAIVER AND SEVERABILITY

No amendment to this Addendum shall be effective unless in writing and signed by authorized representatives of both Parties. Failure to enforce any provision is not a waiver of that provision. If any provision of this Addendum is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

13. ENTIRE AGREEMENT

This Addendum, together with the underlying agreement, constitutes the entire agreement between the Parties with respect to the subject matter herein and supersedes all prior and contemporaneous agreements and understandings, whether written or oral, relating to such subject matter.

14. GOVERNING LAW

This Addendum shall be governed by and construed in accordance with the laws of the state of without regard to its conflicts of law principles.

15. COUNTERPARTS AND ELECTRONIC EXECUTION

This Addendum may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one instrument. Signatures transmitted by electronic means shall be deemed originals for all purposes.

16. MISCELLANEOUS

The Parties acknowledge that the obligations set forth in this Addendum are in addition to, and do not limit, any obligations of confidentiality, security or data protection contained in the underlying agreement. To the extent of any conflict, the terms providing greater protection to Controller shall control.

Controller:

By:

Date:

Processor:

By:

Date:

What the Legal Data Addendum Is

A Legal Data Addendum is a contract attachment that sets specific obligations and controls for shared or processed legal and regulated data. It clarifies categories of protected information, permitted uses, security and retention requirements, audit and access rights, and responsibilities for breaches. The addendum is commonly attached to master services agreements, vendor contracts, and professional services engagements to ensure consistent handling of sensitive records across parties and to support regulatory compliance with U.S. frameworks such as ESIGN, UETA, HIPAA, and applicable tax and employment record rules.

Why Parties Add a Legal Data Addendum

The addendum reduces legal ambiguity by documenting data categories, technical safeguards, incident response duties, and retention policies, helping parties meet statutory and contractual obligations while creating a clear roadmap for audits and dispute resolution.

Who Typically Prepares and Signs the Addendum

A Legal Data Addendum is used by organizations that share or process regulated information and need binding operational rules before work begins.

In-house counsel and contracts teams who manage legal terms and risk allocation between parties.
Compliance officers or privacy leads in healthcare, finance, and education who must enforce regulatory safeguards.
Third-party vendors, SaaS providers, and managed service providers that handle client data under contract.

Each signer should have authority to bind their organization under the main agreement; identify signatory roles clearly to avoid execution disputes.

Who Signs and What Their Roles Are

Data Controller — General Counsel

The organization's general counsel or delegated contracts manager typically negotiates and signs the addendum on behalf of the data controller, ensuring alignment with enterprise privacy policies and overseeing any BAA or regulatory provisions.

Service Provider — Compliance Lead

A vendor's compliance or security lead often completes technical appendices and attests to implemented safeguards, then an authorized officer or VP of Legal executes the addendum to accept contractual responsibilities.

Core Elements Every Professional Addendum Should Include

A well-drafted Legal Data Addendum balances legal precision and operational clarity: define covered data, impose appropriate safeguards, allocate breach responsibilities, and describe audit and retention obligations in measurable terms.

Parties and Scope

Identify the parties, effective date, and the precise categories of legal, personal, or regulated data covered by the addendum; ambiguous scope leads to enforcement disputes and privacy gaps.

Permitted Uses

List authorized processing activities and prohibit secondary uses such as resale or marketing unless explicitly permitted; tie permitted uses to specific service descriptions or SOWs.

Security Controls

Specify technical and organizational measures (encryption, access controls, logging, vulnerability management) with minimum acceptable standards and testing or certification expectations.

Breach Notification

Define timing, content, and responsibilities for incident notification, mitigation, forensic review, and customer communications to meet regulatory and contractual deadlines.

Audit and Reporting

Provide audit rights, frequency, acceptable evidence (SOC 2 reports, third-party assessments), and procedures for addressing non-conformities discovered during reviews.

Retention and Deletion

Set retention periods, secure deletion procedures, and the process for returning or destroying covered data at contract termination, including certificate of destruction requirements.

How to Complete the Legal Data Addendum — Step by Step

Follow these steps to prepare, review, and execute the addendum correctly and reduce execution delays.

01

Gather Documents: Collect master agreement, SOWs, compliance reports, and any required BAAs before drafting.
02

Define Data: List exact data categories and map which party is controller or processor.
03

Set Controls: Specify encryption, access, and monitoring expectations in measurable terms.
04

Execute: Have authorized signatories sign and date; distribute executed copies to stakeholders.

Where to Send or File the Completed Addendum

Routing varies by organization; use centralized contract repositories and ensure both parties retain signed copies for audits and regulatory inquiries.

Legal Repository: Store the executed addendum with the primary contract in the legal document management system.
Compliance Files: Place copies with privacy and compliance teams for monitoring and reporting.
Vendor Portal: Upload signed addenda to vendor management or procurement platforms where applicable.
Client Records: Provide the countersigned copy to the client or contracting party for their records.

Configuring an Online Workflow for the Addendum

Set up an electronic workflow that enforces required fields, signer order, and storage location to reduce errors and demonstrate chain of custody.

Field	Configuration
Required Fields	Make names, dates, and covered-data lists mandatory
Signer Order	Enforce sequence: provider then client signatory
Authentication	Use email + SMS or stronger MFA for high-risk data
Storage Location	Set destination to secure contract repository

Technical and Platform Requirements for eSubmission

Use a platform that supports secure upload, audit trails, and the file formats your legal and compliance teams require.

File formats: PDF, DOCX supported; preserve original formatting
Integrations: Integrate with systems like Salesforce and NetSuite
Authentication: Offer email, SMS, and advanced signer verification

Confirm the platform retains a tamper-evident audit trail and supports export to long-term archives to meet retention and forensic requirements.

eSignature Pricing and Feature Snapshot

Compare common eSignature plan attributes across vendors; signNow is listed first per platform data and includes competitive pricing and core compliance features.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Yes	Yes	Yes	Yes
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies	Varies	Varies

Security and Compliance Capabilities to Require

In transit encryption: TLS 1.2/1.3

At-rest encryption: AES-256 encryption

Certifications: SOC 2 Type II

Healthcare compliance: HIPAA (BAA required)

Regulated records: 21 CFR Part 11 compatible

Standards: ISO 27001 certified

Major Penalties and Contractual Risks to Note

HIPAA Penalties: Civil and criminal penalties (45 CFR)

Information Return Penalties: Penalties under IRC §6721

Backup Withholding: 24% tax rate for missing TIN

Breach Costs: Notification, remediation, potential fines

Contract Damages: Indemnity and liability exposure

I-9 Violations: Civil fines for paperwork failures

Common Preparation Mistakes to Avoid

Using vague data descriptions that force downstream interpretation and increase litigation risk when enforcement questions arise.
Failing to attach required BAAs or technical appendices before processing protected health information, leading to regulatory noncompliance.
Not specifying retention or deletion procedures, which creates uncertainty during audits and can violate recordkeeping rules.
Allowing undefined secondary uses such as analytics or resale without express permission, exposing organizations to privacy violations and contractual breach claims.

Real-World Examples of Addendum Use

These case snapshots show how organizations adapt addenda to operational needs while meeting compliance obligations.

Optica Ventures — COO

To reduce execution time on vendor agreements they standardized an addendum across contracts.

Addendum clarified PHI handling and audit rights.
The company now completes vendor onboarding faster and maintains a single audit trail for compliance reviews.

Fertility Centers of Illinois — Founder

The organization required a BAA and explicit data retention terms in every vendor contract.

They centralized evidence and reporting for audits.
This reduced confusion over responsibilities and simplified incident response and regulator communications.

Frequently Asked Questions About the Legal Data Addendum

Answers to common questions on e-signing, notarization, BAAs, retention, revocation, and signer authority to help avoid execution delays.

Need help? Contact support

Can this addendum be signed electronically?
Yes. Electronic signatures are legally effective under the ESIGN Act (15 U.S.C. ch. 96) and UETA where adopted; ensure consumer-facing disclosures where required and preserve a reproducible record.
Is a Business Associate Agreement required?
If the addendum covers protected health information, a BAA is required to meet HIPAA obligations and should be appended to or incorporated into the Legal Data Addendum.
When is notarization or witnessing necessary?
Most contract addenda do not require notarization, but state law or specific transaction types (real estate, certain powers) may require notarization or witnesses; check local rules.
How can a party revoke or amend the addendum?
Amendments require mutual written agreement as specified in the amendment clause; unilateral revocation is only effective if the agreement permits it or by mutual consent.
How long must parties retain the executed addendum?
Follow the retention schedule in the addendum; federal minima include IRS records (IRC §6501(a)) and HIPAA records (45 CFR §164.530(j)), with state-specific extensions possible.
Who is authorized to sign the addendum?
An authorized officer or individual with contracting authority must sign. Verify delegated authority in corporate records to avoid later challenges to enforceability.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now