Every agreement type the register recognises

The umbrella the other documents hang from: the master agreement, the customer's own purchasing terms, the public framework and the call-off under it. The processing terms, the security schedule, the audit right, the breach clock and the cap usually live here or in a schedule to it.

What the customer uses: the SaaS subscription, the order form under it, the on-premises licence, the API terms, support and hosting. Each is an ICT service when the customer is a financial entity, and each carries the customer's data somewhere.

What the supplier does for the customer: statements of work, professional services, outsourcing, managed services, implementation, service levels, resourcing and exit. Outsourcing and managed services are where the regimes expect the most.

The documents that exist because of the data: the DPA, the BAA, data sharing and data licences, transfer clauses, the CCPA service provider terms and the security schedule. On a customer's other lines, one of these counts as shown.

What comes before the contract: the NDA, the letter of intent, the memorandum of understanding, the pilot and the tender terms. Most carry no processing and no clock; a pilot that touches real data is the exception the register looks for.

How the product reaches customers through others: resale, referral and alliance, OEM and white label, marketplace listings and distribution. The regimes read these lightly unless the partner handles the end customer's data.