# OpenVMO contract clause checklist

OpenVMO v1.0 · Licence: CC BY 4.0 · https://vendorapp.co/openvmo/contracts/

Use for every Tier 1 and Tier 2 contract (practice CON-3). Fill in what the contract actually says. Any "No" is recorded as an accepted risk with an owner and expiry (CON-4). This is a checklist, not legal advice.

| Vendor | Contract | Checked by | Date |
| --- | --- | --- | --- |
| | | | |

| # | Clause | Present? | Where / what it says |
| --- | --- | --- | --- |
| 1 | **Data processing agreement**, with a lawful transfer mechanism where data leaves your jurisdiction | Yes / No / N/A | |
| 2 | **Breach notification** within a stated number of hours (24, 48 or 72 are common) | Yes / No | |
| 3 | **Security obligations**, or a reference to a security schedule | Yes / No | |
| 4 | **Assurance rights**: sharing of reports in place of audit for Tier 2, audit rights for Tier 1 where you need them | Yes / No | |
| 5 | **Subprocessor change notice**, with a right to object | Yes / No / N/A | |
| 6 | **Business continuity** commitments proportionate to how critical the service is | Yes / No | |
| 7 | **Data return and deletion at exit**, with a certificate or written confirmation | Yes / No | |
| 8 | **Termination assistance and notice** periods that give you time to switch | Yes / No | |
| 9 | **AI and model training**: restrictions on using your data to train models | Yes / No / N/A | |
| 10 | **Regulated flow-down** (Level 3, CON-5): terms your regulated customers require, such as DORA Article 30 provisions | Yes / No / N/A | |

## Also record in the register

Renewal date, notice period, and the last day to give notice (CON-2).