Technology work fails in the contract as often as in the code. Scope, delivery, liability, and what happens to the data after the project ends should be written in plain terms.
Data protection is part of that file: who holds the data, where it is stored, who may access it, and what is required if a breach occurs. Those points belong in the agreement, not in a later side letter.
The firm drafts and reviews technology and data contracts so the legal text follows the product, the hosting, and the applicable rules in the countries where the client works.