ASD ISM 1451 Document data ownership in service contracts
What it says
Types of data and its ownership is documented in contractual arrangements with service providers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure contracts with service providers clearly state who owns the data.
When you sign a contract with a service provider, it's essential to clearly define who owns the data that's being handled. If data ownership isn't documented, you might face disputes, lose control over your information, or expose sensitive data to unauthorised parties.
Free. Save your status, tasks and notes.
Why it matters
If data types and ownership aren't documented in service contracts, IP rights may be lost and data use/return can be disputed, increasing risk of unauthorised use or disclosure.
How to implement
Procurement team should include a data ownership clause: Ensure all contracts include a specific clause that outlines who owns the data generated or processed.
Consult with legal advisors to draft clear terms that can be consistently applied.
Legal advisors should review contracts: Before signing, have your legal team go over the contract to confirm that data ownership is clearly stated.
This helps prevent misunderstandings and protects your rights over the data.
IT managers should maintain a checklist: Develop a checklist of must-have contractual terms, including data ownership, especially when engaging with new service providers.
Use this checklist to ensure no critical element is overlooked during negotiations.
Office managers should hold training sessions: Organise sessions for contract administrators to explain the importance of data ownership and how to check for it in contracts.
This ensures that everyone understands the value of securing data ownership.
Compliance officers should conduct regular contract audits: Set a routine for reviewing existing contracts to ensure all have clear data ownership clauses.
Report any missing clauses to legal and management teams for prompt resolution.
Keep it running
Review service contracts for explicit data types, ownership, use, location, retention and return/destruction clauses; update these terms before renewals and when services or data flows change.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Copies of service agreements: Request the latest versions of service contracts with providers.
Look at
Sections specifically detailing data ownership.
Good evidence
Is a clause that explicitly defines data ownership and responsibilities.
- Check 2 of 5What an auditor asks for
Ask for
To see contract review procedures: Request documents showing how contracts are reviewed prior to signing.
Look at
Step-by-step reviews or checklists ensuring data ownership is covered.
Good evidence
Practice is a documented checklist used consistently for all contracts.
- Check 3 of 5What an auditor asks for
Ask for
About training records: Request records of training sessions for those handling contracts.
Look at
Evidence of attendance and a curriculum that includes data ownership. Good practice includes regular training with updated information.
- Check 4 of 5What an auditor asks for
Ask for
Audit reports on contracts: Request recent internal audit reports on contractual compliance. Check if they include assessments of data ownership clauses.
Good evidence
Report identifies any gaps and proposes solutions.
- Check 5 of 5What an auditor asks for
Ask for
Legal review documentation: Request confirmations or sign-offs from legal experts who reviewed the contracts.
Look at
Signatures or notations indicating the data ownership review has been completed.
Good evidence
Sign-off clearly mentions data ownership verification.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.19.
ISM-1451 ensures data types and ownership are clearly documented in service contracts. This specific contractual control supports the broader goal of Annex A 5.19 to manage supplier risk through defined processes, including clarifying data ownership.
This control partially meets A.5.20.
ISM-1451 requires organisations to document data types and ownership in service provider contracts. This is a distinct requirement that fits under ISO/IEC 27001:2022 Annex A 5.20's broader expectation to include security requirements in supplier agreements, such as access controls and incident notification.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.