How to watch suppliers' terms and document the changes

A supplier’s terms, DPA, sub-processor list, security page and SLA are the promises your compliance rests on. All of them are web pages the supplier can edit, and most standard terms say so: “we may update these terms from time to time; continued use constitutes acceptance”. Nobody writes to tell you. This guide covers why that matters, which changes are material, and how you document that you saw a change — so that the version you relied on is a fact you can show rather than a memory.

Why terms change without notice

Three ordinary reasons. The supplier adds a sub-processor and updates the list, because that is what the list is for. Counsel revises the DPA after a ruling or a new set of standard clauses. A product change arrives with a paragraph about using customer content to improve the service. Whether the supplier must tell you depends on the document. GDPR Article 28(2) requires notice of sub-processor changes before they take effect. Regulation (EU) 2019/1150 on fairness and transparency for business users of online intermediation services, Article 3(2), requires marketplaces and app stores to give business users at least 15 days’ notice of changes to their terms. For everything else — general terms, security pages, SLAs — the notice is whatever the contract says, and contracts written by suppliers rarely say much.

Why it is your problem

Under the GDPR the processor acts on your documented instructions (Article 28(3)(a)), so a changed DPA changes what you have instructed. Your Article 30 record must reflect the current recipients and transfers, not last year’s. Article 5(2) makes you accountable for demonstrating compliance, and Article 24(1) requires you to review and update your measures “where necessary”. A supplier that moved its hosting to another country has made an update necessary whether or not you noticed.

Under NIS2, for entities in scope, Article 21(2)(d) of Directive (EU) 2022/2555 requires supply-chain security “including security-related aspects concerning the relationships between each entity and its direct suppliers”, and Article 21(3) asks you to take account of “the overall quality of products and cybersecurity practices” of those suppliers. A supplier’s security page is your evidence of its practices; if it changes, so does your assessment. Your customers in scope will ask the same about yours.

Under the contract, the version in force when something goes wrong decides what the supplier owes you. If the liability cap was halved in March and the incident was in June, you want to show what you accepted, when, and whether you were told.

What counts as a material change

A material change alters what the supplier promises or what happens to your data. This is the list worth checking a difference against:

• Sub-processors added, removed or moved to another country; a changed notice period or right to object.
• Data location and transfers: a new region, a different transfer mechanism, a sub-processor outside the EU and EEA.
• Retention and deletion: a longer retention period; a deletion promise that becomes “in accordance with our policy”; backups excluded.
• Security commitments: encryption, MFA, certifications, penetration testing, logging — anything removed or softened.
• Breach notification: a window that grows or disappears.
• AI and training data: a new right to use customer content for model training or “service improvement”.
• Audit rights, liability caps, indemnities, governing law.
• SLA terms: availability, service credits, maintenance windows, support channels and hours.
• The legal entity: an assignment clause or a new contracting party after an acquisition.

Not material, but worth recording: a new address, a renamed product, reformatting, a corrected typo. The distinction matters because a review process that treats every edit as an alert is switched off within a month.

How you document that you saw it

The evidence that stands up is the text before, the text after, the difference between them, and a note of who looked and what they decided. Per document:

1. A dated copy of the version you relied on. The supplier’s “last updated” line is the supplier’s claim, not your evidence.
2. The check. How often you re-read the page, and a record that the check ran even when nothing changed. “We check monthly” is a policy; a log of the checks is evidence.
3. The difference, paragraph by paragraph, so the reviewer reads what changed rather than the whole document again.
4. The judgement. Material or not, by whom, on which date, with one line of reasoning.
5. The action. Accepted; questions sent; objection lodged under Article 28(2); supplier replaced — and the supplier’s reply.
6. The update to your own record. If the change moved data or added a recipient, your Article 30 record changes the same day.

Keep the history. “When did you find out that supplier X started using sub-processor Y?” is answered by the log, not by anyone’s recollection.

The questions to put to the supplier

1. How do you announce changes to your terms, DPA, sub-processor list and security page, and how far in advance?
2. Where is the change history for each of those documents?
3. Does the change dated [date] apply to our existing agreement, or only to new customers?
4. If we do not accept it, what are our options and by when?

How Maditon does this

Maditon re-reads every watched document on a schedule, compares the new text with the last version paragraph by paragraph, and asks a model whether the difference is material: a retention period, a transfer mechanism, a new sub-processor. You get one e-mail a day listing what changed and what could not be read, and the app keeps both versions and the difference, so the summary is something you check against the supplier’s own words rather than take on trust. A change the model could not read is recorded as unclassified, never as “not material”, because nobody checked it. Documents of a supplier you marked as in use are watched automatically, and the history of fetches and changes stays with the document.

The mechanics are in How does Maditon know when a supplier changes their terms? and what is kept in Is Maditon an archive of my contracts?. Or put your suppliers’ documents under watch in the app.