Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
Most UK businesses now run payroll, customer records, email and finance on third-party cloud software. Where a supplier handles personal data on your behalf, Article 28 of the UK GDPR requires a written contract setting out the subject matter, duration, type of data, security measures and sub-processor arrangements. Standard click-through terms often fall short, and as controller you remain accountable to the ICO if the supplier’s terms leave gaps. The Data (Use and Access) Act 2025 has also updated parts of the UK data protection framework, so older agreements are worth rechecking.
Beyond data protection, contracts should deal with service levels, liability caps, data location, backup, incident notification and what happens when you leave. The Unfair Contract Terms rules and Contracts (Rights of Third Parties) Act 1999 may matter, and the Cyber Security and Resilience Bill is expected to bring managed service providers into scope of tighter incident rules. A supplier failure, price change or insolvency can stop your business trading, so a structured review of your key contracts is a cheap safeguard.
