The GDPRLocal Master Service Agreement and additional Terms herein govern our products, services and customer relationships.
There are no requirements to purchase services. No credit card needed to sign up, and once registered services may be purchased and activated at any time.
This Schedule forms part of the Master Services Agreement (“Agreement”) between the Customer and GDPRLocal Ltd (“GDPRLocal”). It sets out the scope of AI Governance Services delivered by GDPRLocal, supporting the Customer in the design, governance, maintenance, and continuous improvement of its AI Management System (“AIMS”) as described in the Statement of Work that forms an Appendix to this Schedule. Terms used in this Schedule have the same meaning as in the Master Services Agreement.
In this Schedule: “AIMS” means the Customer’s AI Management System, being the framework of policies, procedures, roles, controls, registers, and monitoring activities established by the Customer for the responsible design, governance, and operation of its AI systems; “AI Tracker” means the record maintained on GDPRLocal’s portal capturing the Customer’s AI systems, associated risks, controls, and lifecycle events.
1.1 Overview. GDPRLocal shall provide the Customer with ongoing advisory support and framework guidance in the design, governance, maintenance, and continuous improvement of its AIMS, as described in clause 1.2 and in the Statement of Work.
1.2 Core Pillars. GDPRLocal shall provide advisory support across the following four core pillars of the AIMS:
(a) AI Governance and Accountability
(b) AI Risk Management
(c) Ethics and Transparency
(d) Continuous Monitoring and Improvement
1.3 Access to GDPRLocal Resources. In addition to the monthly-provided services, the Customer shall have ongoing access to GDPRLocal’s portal and to the documentation produced by GDPRLocal for the Customer as part of this Agreement.
2.1 Service Delivery. GDPRLocal shall deliver the Services described in the SOW in accordance with the scope set out in this Schedule and at intervals agreed between the Customer’s designated representative and GDPRLocal’s compliance executive, taking into account the nature, scope, context, and risk profile of the Customer’s AI governance posture.
2.2 Advice and Reporting. GDPRLocal shall provide advice, recommendations, and reports within timeframes agreed between the parties in the SOW, taking into account the complexity and urgency of the matter. The form, frequency, and timing of any reports, meetings, or other deliverables shall be as set out in the applicable SOW.
In addition to the obligations set out in MSA §6, the Customer shall:
3.1 designate a primary contact person responsible for coordinating with GDPRLocal in relation to the Services;
3.2 ensure timely access to relevant stakeholders, including representatives from Data & Engineering, IT, Legal, Risk Management, HR, and any other relevant departments, as reasonably required for the performance of the Services;
3.3 determine or confirm, on a monthly basis, the priorities and focus areas for the Services;
3.4 provide, in a timely manner, all inputs, information, instructions, approvals, access, and other cooperation reasonably required for GDPRLocal to perform the Services; and
3.5 retain sole responsibility for the identification, assessment, acceptance, mitigation, and reporting of AI-related risks and incidents, and for the adoption, implementation, and ongoing operation of any policies, procedures, or documentation delivered by GDPRLocal.
4.1 GDPRLocal provides oversight, framework design, and advisory services only, and does not assume any operational, managerial, or decision-making role within the Customer’s organisation.
4.2 GDPRLocal does not act as an AI Risk Owner or AI Incident Owner. Ultimate accountability for the identification, assessment, acceptance, mitigation, and reporting of AI-related risks and incidents remains solely with the Customer.
4.3 The Services constitute governance and compliance consulting and do not amount to formal legal advice or legal opinions. The Customer is responsible for obtaining independent legal review of all policies, procedures, and documentation prior to adoption or implementation.
4.4 The Services do not include advice or guidance related to technical implementation or product development activities, including without limitation writing code, conducting software testing or security testing, building or training models, engineering system architectures, or acting as developers, engineers, or data scientists.
4.5 Targeted research on AI regulatory developments and applicable laws, and advising the Customer on updates to the AIMS required to maintain alignment with evolving requirements, is outside the scope of the Services and shall be treated as an Additional Service under clause 5.
4.6 Any services outside the scope of clauses 1 and 2 may be requested as billable Additional Services in accordance with clause 5.
5.1 Scope. The Services are limited to the deliverables and activities set out in the applicable SOW.
5.2 Additional Services. Where GDPRLocal identifies a request or requirement that falls outside the SOW scope (including any of the items listed at clause 4.5), GDPRLocal shall notify the Customer in writing (email sufficient) together with a good-faith estimate of the additional time or cost involved. Additional Services shall not commence until authorised by the Customer in writing (email sufficient).
5.3 Billing. Additional Services authorised under clause 5.2 are billed at the applicable Rate Card rate unless the parties expressly agree a different fee in writing prior to the work commencing.
5.4 SOW variation. Where Additional Services represent a material extension of the engagement, the parties shall agree a written variation to the SOW recording the revised scope, timeline, and fees.
5.5 Records. GDPRLocal maintains records of time and activity performed under the SOW, and shall make these available to the Customer on reasonable request.
6.1 Advisory nature. The parties acknowledge that the Services are advisory in nature. GDPRLocal does not warrant the outcome of any AI risk assessment, AI impact assessment, review, or governance activity, and does not accept responsibility for any decision taken, or action performed, by the Customer on the basis of GDPRLocal’s advice or deliverables. The Customer remains solely responsible for the adoption, implementation, and operation of any policies, procedures, or recommendations delivered by GDPRLocal.
6.2 Limitation of Liability. Subject to clause 6.4, the aggregate liability of either party under this Schedule shall not exceed the total fees paid or payable by the Customer in respect of the Services in the twelve (12) month period immediately preceding the event giving rise to the claim. Neither party shall be liable for indirect, consequential, special, or punitive loss.
6.3 Customer responsibility. Without limiting clause 6.2, GDPRLocal shall have no liability for, and the Customer retains sole responsibility for: any harm, damage, or loss caused by or arising from the Customer’s AI systems themselves, their outputs, performance, or safety; any regulatory fine, penalty, or sanction imposed on the Customer; any loss arising from the Customer’s failure to implement, adopt, or maintain policies, procedures, or controls recommended by GDPRLocal; and any loss attributable to the Customer’s inactivity, delay, or failure to cooperate as described in clause 6.5 or under MSA §5.9.
6.4 Exclusions from Limitation. The liability cap in clause 6.2 does not apply to: liability for death or personal injury caused by negligence; fraud or fraudulent misrepresentation; or any other liability that cannot be limited by applicable law.
6.5 Failure to Cooperate (Service-specific). Where the Customer becomes unresponsive or fails to provide required monthly priorities or timely inputs, MSA §5.9 (Failure to Cooperate) applies. For this Service, the relevant service period under MSA §5.9 is the monthly service period.
7.1 Term. This Schedule commences on the Service Start Date and continues for an initial term of twelve (12) months (the “Initial Term”), unless terminated earlier in accordance with this clause 7 or MSA §12. It auto-renews for successive twelve (12) month Renewal Terms unless a party gives written notice of non-renewal in accordance with clause 7.2.
7.2 Termination for Convenience. Notwithstanding MSA §12.3, either party may terminate this Schedule for convenience by providing at least thirty (30) days’ prior written notice to the other party by email, such notice to be effective prior to the start of the next monthly billing cycle.
7.3 Post-termination export. Upon termination, and subject to payment of all outstanding fees, GDPRLocal shall provide the Customer with a final export of the AI Tracker.
7.4 Survival. Clauses 4, 6, and this clause 7 survive termination.
This Statement of Work (“SOW”) is appended to and forms part of Service Schedule 5 (AI Governance Services), which in turn forms part of the Master Services Agreement between the Customer and GDPRLocal Ltd. Capitalised terms have the same meaning as in the Schedule or the Agreement.
The SOW is generated and recorded by GDPRLocal at the point of Service activation. Placeholder fields shown in square brackets are populated from the Customer’s account and the Service Activation Record.
| Company Name | [Company Name] |
| Registered address | [Registered address] |
| Primary Contact | [Contact Name] |
| Role | [Contact Role] |
| [Contact Email] | |
| Telephone | [Contact Number] |
| AIMS coverage | [list of business units, functions, or AI systems in scope of the AIMS] |
| Priority focus areas at activation | [initial priorities agreed at onboarding] |
| Monthly meeting cadence | [e.g., first Thursday of each month at 14:00 UK] |
| Reporting cadence | [e.g., monthly written status update; quarterly summary] |
| Territory of operation | [jurisdictions where the Customer’s AI systems are deployed or accessible] |
All fees for this Service are set out in the MSA Rate Card. The Service comprises the following fee categories:
| AI Governance subscription | As set out in the Rate Card. Payable monthly from the Service Start Date. |
| Additional Services (regulatory research, project or consultancy work beyond the subscription scope, or scope items expressly identified as Additional Services under Schedule §4.5) | At the applicable Rate Card rate, subject to prior written authorisation under Schedule §5. |
| Billing cadence | [monthly / annual] |
| Currency | GBP, exclusive of VAT and any applicable taxes. |
| GDPRLocal AI Governance Lead | [Name to be notified on activation] |
| GDPRLocal entity | GDPRLocal Ltd |
| Registered address | 1st Floor Front Suite, 27-29 North Street, Brighton, England, BN1 1EB |
| [email protected] | |
| Tel | +44 1772 217 800 |
Each party shall notify the other of any permanent change to its designated personnel within thirty (30) business days of the change.
The table below outlines the range of AI Governance deliverables that may be provided under this SOW, based on priorities agreed at the monthly meetings and confirmed in the monthly plans.
| AIMS Service Area | Deliverables |
|---|---|
| AI Governance and Accountability | AI PolicyAI Governance PolicyAIMS Scope PolicyRoles and Responsibilities MatrixAI Support and Operations PolicyAI Resources ProcessPrivacy Policy alignment to AIMST&C alignment to AIMSBusiness Continuity Plan alignment to AIMSRegister of Legal and Regulatory Requirements aligned to AIMS |
| AI Risk Management | AI Risk RegisterAI Risk Management PolicyAI Impact Assessment processAI Risk Assessment MethodologyAI Risk Assessment template (NIST)AI Risk TreatmentAI Risk Treatment PlanAI Impact Assessment MethodologyAI Impact Assessment template (Microsoft)AI Impact Assessment ReportAI Tool Approval ProcessAI Tool Risk AssessmentAI Tool RegisterAI Incident Response PlanAI Incident Response ChecklistAI Incident RegisterAI Incident Classification Scheme |
| Ethics and Transparency | AI Model Card (external)AI Model Operational Use Policy (internal)AI Use Policy (external)AI Acceptable Use Policy (internal)AI Literacy Process with supporting formsAI Training PlanAI Literacy Employee Handbook |
| Continuous Monitoring and Improvement | AI Improvement PolicyAI TrackerAI Performance EvaluationAI Corrective Action FormPost-market AI System monitoring planInternal Audit Process with supporting forms (Internal Audit Programme, Internal Audit Report, Internal Audit Checklist) |
Note: targeted research on AI regulatory developments and applicable laws, and advising the Customer on updates to the AIMS required to maintain alignment with evolving requirements, is outside the scope of the subscription and is treated as an Additional Service under Schedule §5 (see also Schedule §4.5).
This SOW may be reviewed and updated by written agreement between the parties where required to reflect material changes to the Customer’s AIMS, service requirements, or compliance priorities. Any such update will be recorded as a revised SOW associated with the Customer’s account.
This SOW is deemed accepted by the Customer at the moment of Service activation (whether via in-portal activation or written confirmation accepted by GDPRLocal).