This section sets out the legal underpinning for data protection in the context of a company’s business activities and contractual relationships with other parties. It explores the notion of cyber-risk, pitfalls to avoid and items that must be included in contracts.