Documents in this cluster
Data Processing Agreement
Processor terms. Needed whenever a destination vendor sees personal data. Startups skip this until a Singapore or EU buyer asks.
A data processing agreement is named before hours start — processor terms when a destination vendor sees personal data. Parties, language, and governing-law preference sit as facts for local licensed review.
The Matter Pack for a data processing agreement records who signs, which language is the working draft, and which missing names would change the price. Orbid does not fill those gaps with legal advice.
Startups usually buy this data processing agreement as a first single matter. Mid-market teams that issue the same form many times in a quarter put it inside an annual counsel module.
Default for a data processing agreement is one scoped price. A retainer only makes sense when review volume is recurring. If the project changes, a change order states the new price.
Data Sharing Agreement
Controller-to-controller sharing, not processing. Joint marketing and group companies use it.
Cross-border, a data sharing agreement is paper, not a vibe: controller-to-controller sharing, not processing. A destination professional prices review of that named instrument.
For this data sharing agreement the pack lists counterparties, term, territory if any, and the files you already have. Unknowns stay gaps, not extra hours.
A startup sees one data sharing agreement. A mid-market desk sees a template: same skeleton, many counterparties, still reviewed locally per pack.
One data sharing agreement is a single matter unless you already run a cadence of the same form. Extra unnamed paper is not included.
Data Transfer Agreement
A named transfer mechanism. Distinct from the DPA that sits under it.
If the file crosses a border, write the data transfer agreement into the pack first — a named transfer mechanism, distinct from the DPA under it. Unknowns stay gaps.
A data transfer agreement pack asks which entity on the origin side contracts, which destination name appears, and whether a bilingual draft already exists.
If this is the first data transfer agreement on the corridor, default is a single matter. If it is the twelfth this quarter, that is a module conversation — Orbid coordinates, and licensed local counsel judges.
Do not stretch one data transfer agreement price over a second instrument. That is how surprise bills start. Split, or write a change order.
Standard Contractual Clauses
Standard contractual clauses for some outbound transfers. US systems holding EU/UK data often need this pointer.
Hours do not start on an unnamed standard contractual clauses — a pointer often needed when US systems hold EU or UK data. Local licensed review sees who signs and which language is the working draft.
What sits in the pack around a standard contractual clauses: asserted facts, planned entities, and the triggers that would reopen price. Orbid does not choose the clause.
Founders often over-buy a stack around a standard contractual clauses. Mid-market operators under-specify the program. The pack names the actual count.
A retainer that mentions a standard contractual clauses still uses a Matter Pack per issuance. Scoped packs, not unlimited advice.
Subprocessor Agreement
The vendor’s vendor. Mid-market buyers want the list as a pack fact.
On this corridor the subprocessor agreement is the instrument to price — the vendor’s vendor; mid-market buyers want the list as a fact. Orbid records that; it does not advise which form you should have chosen.
The subprocessor agreement line in the pack is a scope, not a draft. Local licensed professionals review what you approved; they are not Orbid employees giving advice in our name.
Startups: one subprocessor agreement, one price, approve before hours. Mid-market: the form lives in a retainer quota, each issuance still a pack.
If this subprocessor agreement grows a neighbour — a DPA, a quality paper, a SHA — name the set or pay a second price.
Privacy Addendum
Adds privacy terms onto an MSA or SaaS form that lacked them.
Name the privacy addendum while talks are still cheap — privacy terms added onto an MSA or SaaS form that lacked them. A listed destination still accepts the scope; a standing lawyer there is not promised.
Record the privacy addendum with the commercial neighbours it actually has — not a dump of every PDF in the folder. Extra unnamed files are a change order.
The first privacy addendum on a corridor is usually a startup single matter. A net of them is mid-market, and the default flips to an annual module.
Single-matter fits a bounded privacy addendum. Weekly flow of the same form belongs on an annual counsel module.
Security Addendum
Technical and organisational measures. Numbers the client already claims belong in the pack.
A security addendum belongs in the pack — technical and organisational measures the client already claims. Thailand is live review; other corridors stay listed.
Gaps on a security addendum — missing signatory, missing language, missing term — stay written. They do not convert into silent hourly work.
Do not put a startup security addendum on a retainer because it feels safer. Retainer is for recurring review volume, not for nerves.
You approve the security addendum pack before hours. You approve again if the facts move. The price does not jump in silence.
Information Security Agreement
A standalone information-security agreement, heavier than an addendum.
Do not paste an origin information security agreement across the border unmarked — a standalone security contract, heavier than an addendum. The pack asks which language controls and which entity signs.
The pack treats the information security agreement as one priced module unless you name a defined set. A pile of related attachments is not a defined set.
Mid-market counsel modules still scope each information security agreement. Unlimited chat about the form is not the product.
Listed-corridor information security agreement work is still scoped as a single matter or a module. Scope is accepted; a named lawyer standing by is not promised.
Data Breach Response Addendum
Who notifies whom, and in how many hours, as the client already promised customers.
The first priced Matter Pack is often this data-breach response addendum, given that who notifies whom, in how many hours, as already promised to customers. Local licensed professionals review; Orbid does not draft as counsel.
Who already signed a previous data-breach response addendum, and who still has to, is a fact. Orbid records it. Enforceability is not an Orbid opinion.
If the startup does not yet have a destination entity, the data-breach response addendum may still be scoped — as paper, not as incorporation.
A data-breach response addendum change order is the exception path: new scope, new price, your yes. It is not a vibe adjustment on the old invoice.