Putting the Charter into a contract a vendor will sign

A charter binds the institution that adopts it. It does not bind a supplier. The Ethical Technology Charter was adopted by the Board in 2023 and governs every automated decision the group makes, but roughly a third of the systems involved in those decisions are operated by third parties. The Third-Party Risk and Outsourcing policy closes that gap by turning seven principles into five clauses that a commercial supplier will sign without a six-month negotiation.

The vendor register held 214 contracts at 30 June 2025. Sixty-one of them process client data or supply an input to a model, and those 61 were rewritten between the second quarter of 2024 and the second quarter of 2025. The remaining 153 contracts, covering office services, travel, insurance broking and similar, were left alone. Applying a data-governance clause to a supplier of cleaning services produces an expense with no control attached to it.

The five clauses are short. The supplier names an accountable individual for the service. The supplier warrants the origin and the lawful basis of any dataset it provides. The supplier makes no secondary use of group or client data and trains no model on it. The group may audit the service on ten business days notice. The group may exit within 90 days and receive its data back in a documented, readable format at the supplier cost.

Seven suppliers refused a clause. Three were replaced. Four were retained with a compensating control: a shortened term, a restricted dataset, or a copy of the data held on group systems so that the exit clause becomes unnecessary. Every refusal and every compensating control is recorded in the register with the name of the person who accepted it. That is the first Charter principle applied to a procurement decision rather than to an investment decision.

Two positions are not negotiable and no compensating control substitutes for them. No supplier may sell, share or monetise client data under any commercial arrangement. No supplier may deploy facial recognition or biometric inference in any service supplied to the group. Both appear in the Charter, both appear in the contract, and both accounted for two of the three replacements. The third replacement followed a refusal to name an accountable individual for the service.

The rewrite took 14 months and about 1,900 hours of legal and technology time. The recurring cost is the annual attestation: each of the 61 suppliers confirms in writing that the clauses have held, and eleven of them are audited each year on a three-year cycle. The register goes to the Information Governance Committee twice a year. A supplier that cannot attest is not a supplier the group keeps, whatever the cost of switching turns out to be.

Published 2025-08-12 by the Information & Data division. Research is prepared for eligible counterparties and does not constitute advice.