Keyword research contracts: what to check before signing

What to take away

This guide covers keyword research contracts for buying or licensing research: tool subscriptions, freelance briefs, agency retainers and data licences. For contracts governed by the law of England and Wales, say so expressly; Scotland has its own contract law and court procedures. UK GDPR, the Data Protection Act 2018 and PECR apply across the UK. Individual agreements need a qualified adviser.

What counts as a keyword research commercial contract?

Most teams sign more than one. A tool subscription is a licence. A freelance brief is a services contract with deliverables attached. An agency retainer mixes both, and may add a clause about reusing method on other accounts. Check whether it lets the agency reuse your exact keyword set, search-intent mapping or client-specific findings for a competitor; state what can be reused, and whether it must first be anonymised.

Read each one against the job it does, rather than forcing a single template. Two questions sort them quickly: who can reuse the output, and what happens when the term ends?

A licence that stops on cancellation can leave a team without historical data it has paid for over years. That belongs in the exit clause.

What belongs in the scope and deliverables clause?

State the number of revisions and the turnaround time. Otherwise ongoing optimisation can mean anything, and a supplier can bill for work the buyer assumed was included.

The change process should state who approves extra scope, how the supplier prices it and whether delivery dates move. Keep revision limits, turnaround times and extra-scope rates explicit. The wider rules behind these clauses sit in the keyword research rules and compliance guide, which brings data, disclosure and record-keeping together.

Add a confidentiality clause covering client briefs, unpublished keyword sets, search-intent mappings and CRM-derived insights. A limitation of liability clause and an indemnity clause should allocate responsibility for losses, including intellectual property infringement, unauthorised disclosure and data breaches; check their scope, exclusions and interaction.

How should personal data be handled?

The UK GDPR, supplemented by the Data Protection Act 2018, sets the framework for personal data. Record the lawful basis for each processing purpose: consent, contract, legal obligation, vital interests, public task or legitimate interests. Do not choose a basis merely because the contract labels it lawful.

When a supplier processes personal data on the client's instructions, identify the controller and processor roles and attach a data processing agreement (DPA) with Article 28 UK GDPR terms. Specify the processing subject matter, duration, nature and purpose, data types and data-subject categories, as well as documented instructions, confidentiality, security, subprocessor controls, assistance, return or deletion and audit information. Name any subcontractor handling transcription or coding, and set notice and approval or objection steps before a change.

Check whether a supplier or subprocessor will access personal data outside the UK. Where a restricted transfer needs a safeguard, specify the UK International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (UK Addendum), as appropriate.

The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) regulate electronic-mail marketing, and the ICO's business-to-business marketing guidance explains how they apply. Unsolicited marketing email to corporate subscribers may be sent without prior consent, but sender identification and an opt-out route are required; sole traders and some partnerships are treated as individual subscribers and generally need consent, subject to the soft opt-in. Check any clause that assumes blanket consent.

What about claims and disclosure?

If a client advertises into the United States, section 5 of the FTC Act prohibits unfair or deceptive acts or practices. The FTC's Guides Concerning the Use of Endorsements and Testimonials in Advertising (16 CFR Part 255) address endorsements and material connections. Name who must substantiate each claim and disclose paid endorsements so evidence and approvals are ready before publication.

For UK ads, check the applicable code: the CAP Code covers non-broadcast advertising and the BCAP Code covers broadcast advertising. The Advertising Standards Authority (ASA) handles complaints under these codes. Put the proof in the same folder as the keyword brief, with a note of where each figure came from.

What steps come before signing?

Contract law and court procedures differ in Scotland, so do not treat English and Welsh terms as automatically suitable for a Scottish governing-law contract. UK GDPR, the Data Protection Act 2018 and PECR apply across the UK; for a country-specific overview, see keyword research regulations in England.

Common questions

Who owns the keyword lists?

That depends on the contract, not on who typed the list. Copyright in written output generally starts with its author, subject to exceptions such as employee-created work, so payment alone should not be treated as an assignment. Include an IP assignment clause: an assignment of copyright must be in writing and signed by or on behalf of the assignor under the Copyright, Designs and Patents Act 1988. Name the rights transferred and any licence-back, and address copyright in the written output in the clause.

Does UK data protection law apply?

Yes, wherever personal data is processed. Exports, interview notes and panel records all count. Search volume data on its own usually does not.

Can a supplier reuse client data?

The agreement should state whether reuse is allowed and define its limits. Do not accept blanket permission without addressing client-identifiable keyword sets, search-intent mappings and confidential findings used for competitors; if reuse is intended, specify what may be reused and whether it must first be genuinely anonymised. Match the wording to the confidentiality clause and data protection restrictions.

Do US rules affect a UK contract?

They can, when the content reaches US audiences. A clause requiring evidence for claims and disclosing paid endorsements covers both markets. Take advice on your own facts.