18 May 2018

NEC4 Practice Note Issued – Complying with GDPR

This note provides guidance on the information that needs to be included in an NEC4 contract which includes the processing of personal data as defined in the GDPR in order to comply with Article 28. It describes the requirements in relation to an NEC4 Engineering and Construction Contract (ECC), but equivalent clauses would be needed on other NEC4 contracts when applicable. Any processing of personal data must be carried out in accordance with other requirements of GDPR; this practice note does not extend to those requirements.

NOTE: Similar provisions are needed in the Works Information or equivalent of an NEC3 contract which requires the processing of personal data. The terms should be changed to reflect the defined terms in the appropriate NEC3 contract.

If an NEC3 or NEC4 contract has already been awarded, the Scope (or equivalent) may need to be changed to add in any of these provisions that are not already covered by the contract. Such a change would be a compensation event.

Click here to download practice note

Recent news

22 September 2026

Trained to Deliver: new NEC Contracts research maps the gap between belief in training and investment in it

NEC Contracts has published Trained to Deliver..., the third in a series of global research studies following 2025's Transforming Construction and 2026's Trust, Contracts and Outcomes.

14 August 2026

2026 NEC Training in the UK

From new starters to experienced professionals, our 2026 training equips you to navigate NEC contracts with clarity, manage risks effectively, and deliver projects collaboratively.

21 July 2026

NEC Contracts and Project 13 publish new guidance on NEC for Enterprise models

NEC Contracts and Project 13 have jointly published new guidance on the use of the NEC4 suite within Enterprise models.

View all news