Comparisons

Amendment vs Addendum An amendment changes the wording of an existing contract, such as a new price or a revised clause. An addendum adds new terms on a topic the contract did not cover, such as data protection or AI use. Both become part of the same agreement. Controller vs Processor Under GDPR, a controller decides why and how personal data is used, while a processor handles that data on the controller's behalf and follows its instructions. When you use a SaaS tool for your customers' data, you are usually the controller and the vendor is the processor. Data Residency vs Data Sovereignty Data residency is where your data is physically stored, such as servers in the EU or the US. Data sovereignty is which country's laws apply to that data and who can demand access to it. Storing data in one country does not by itself decide which laws reach it. DPA vs Privacy Policy A DPA is a contract that sets how a vendor handles personal data on your behalf. A privacy policy is a public notice telling people how a company uses their data. As a business customer, the DPA is what binds the vendor to you. Enterprise vs Consumer AI Terms Many AI products have consumer plans for individuals and business plans for companies, each with its own terms. The same model can sit behind both, but the rules on training, retention and data ownership can differ by plan. GDPR vs CCPA GDPR is the EU privacy law, and it requires a legal reason for every use of personal data of people in the EU. The CCPA is California's privacy law for larger businesses, and it centers on rights such as opting out of the sale or sharing of data. Limitation of Liability vs Indemnification A limitation of liability clause caps how much one side can owe the other if something goes wrong. An indemnification clause makes one side cover the other's costs when a third party sues. The two work together, since the cap can decide how much an indemnity is really worth. MSA vs Terms of Service A master service agreement (MSA) is a contract you negotiate and sign with a vendor. Terms of service are standard online terms the vendor writes and you accept by clicking or using the product. When both exist, the documents themselves decide which one wins. Processor vs Subprocessor A processor works directly for you under its own contract with you, while a subprocessor works for your processor under a contract with it. Your processor stays fully liable to you for its subprocessors. SCCs vs Data Privacy Framework Standard contractual clauses (SCCs) and the EU-US Data Privacy Framework (DPF) are two legal ways to move personal data from the EU to the US. SCCs are contract terms signed between two companies; the DPF is a program a US company joins by self-certifying with the US Department of Commerce. Selling vs Sharing Data (CCPA) Under the CCPA, a "sale" is giving personal information to a third party for money or anything else of value. "Sharing" is giving it to a third party for ads based on what a person does on other sites and apps, paid or not. SOC 1 vs SOC 2 A SOC 1 report covers a vendor's controls that can affect your financial reporting, such as payroll or billing processing. A SOC 2 report covers controls for security, availability, processing integrity, confidentiality and privacy. For most SaaS tools, SOC 2 is the one to ask for. SOC 2 Type 1 vs Type 2 A SOC 2 Type 1 report checks whether a vendor's security controls are well designed on a single date. A Type 2 report also tests whether those controls actually worked over a period of months, which makes it stronger evidence. SOC 2 vs ISO 27001 SOC 2 is a US audit report, written by a CPA firm, on how well a vendor's security controls are designed and run. ISO 27001 is an international certification that a vendor runs a managed security program. Both are useful, and SOC 2 gives you more detail to read. Terms of Service vs Privacy Policy Terms of service are the rules for using a product: what you may do, what you pay, and who is liable when things go wrong. A privacy policy explains what personal data the company collects, why, and who it shares it with. Third-Party vs Fourth-Party Risk Third-party risk comes from the vendors you sign up with directly. Fourth-party risk comes from your vendors' own vendors, such as the cloud hosts and AI providers they use to run their service. You have a contract with the first group, but usually not with the second.