Data Processing Agreement UK Guide 2026: GDPR Compliance, Legal Requirements & Tax Implications [Complete Guide]

Updated: February 2026 • Based on UK Law

A London-based recruitment agency uses three cloud platforms — a CRM, an applicant tracking system, and a background check provider. All three process candidate personal data daily. None has a Data Processing Agreement in place. The ICO investigates after a candidate complaint and finds not one, not two, but three separate Article 28 breaches. The agency faces enforcement action on each. Maximum penalties under UK GDPR: £17.5 million or 4% of global turnover — per breach.

Meanwhile, a competitor running the same three platforms has signed DPAs with every processor. Same complaint, same investigation. The ICO reviews the agreements, confirms compliance, and closes the case in weeks.

Every cloud service, every marketing platform, every payroll provider that touches personal data requires a written contract under UK GDPR Article 28. No exceptions. No grace period.

This guide covers UK GDPR Article 28 requirements, controller and processor duties, Data Use and Access Act 2025 updates, and breach obligations, with a free interactive DPA checklist.

---

What Is a Data Processing Agreement in the UK?

Quick Answer: A legally binding contract between a data controller and data processor that governs how personal data is handled, processed, and protected under UK GDPR Article 28.

Why Every Business Needs One

Under the UK GDPR and Data Protection Act 2018, any organisation that engages a third party to process personal data must establish a written contract. This isn’t optional — it’s mandatory under Article 28.

The agreement ensures data processors operate exclusively under the documented instructions of data controllers, maintaining data protection standards whilst enabling legitimate business operations.

When Does a DPA Come Into Play?

Whenever you use cloud services, engage IT contractors, hire marketing agencies, employ payroll providers, or work with any third-party service that accesses personal data. Common examples: CRM systems, email marketing platforms, accounting software, and HR management systems.

The Eight Core Elements

UK GDPR Article 28(3) mandates eight elements: the subject matter and duration of processing, the nature and purpose of processing, types of personal data and categories of data subjects, obligations and rights of the controller, specific processor duties including security measures, sub-processor arrangements, data deletion or return procedures, and audit rights for the controller.

What Changed Under the Data Use and Access Act 2025?

The DUAA received Royal Assent on 19 June 2025 and introduced enhanced provisions for scientific research, automated decision-making safeguards, and streamlined international transfer mechanisms. The fundamental requirement for robust DPAs remains unchanged.

For organisations establishing their legal compliance framework, understanding DPAs forms part of a broader UK business legal template strategy.

---

Are UK GDPR and DPA the Same?

Quick Answer: No. UK GDPR is the overarching regulation governing data protection. A DPA is a specific contract required under Article 28 to regulate processor relationships.

The Critical Distinction

UK GDPR is the comprehensive legislative framework governing how all personal data must be processed in the UK — seven fundamental principles, individual rights, controller and processor obligations, and legal bases for processing.

A DPA is a specific contractual document that only applies when one organisation engages another to process personal data on its behalf. Think of UK GDPR as the law — and the DPA as one contract that helps you comply with one aspect of that law.

Where Does the Data Protection Act 2018 Fit In?

The DPA 2018 is the UK’s implementation legislation supplementing UK GDPR. It provides additional detail on law enforcement processing, intelligence services processing, and various exemptions.

Post-Brexit and DUAA 2025 Changes

The UK maintains its adequacy decision with the EU, meaning UK GDPR standards remain substantially equivalent to EU GDPR. The DUAA introduced a new “recognised legitimate interests” lawful basis, relaxed rules on automated decision-making, and a revised “data protection test” for international transfers requiring protections “not materially lower” rather than “essentially equivalent.”

Your DPA must comply with UK GDPR but represents just one element of your broader data protection strategy — alongside privacy policies, cookie policies, and terms and conditions as part of your complete website legal documentation.

---

How Does a Data Processing Agreement Work?

Quick Answer: A DPA creates a contractual obligation restricting the processor to acting exclusively on the controller’s documented instructions — what data they can access, what operations they can perform, how long they retain data, and what security measures they must implement.

The Fundamental Mechanism

The processor cannot make independent decisions about why personal data is processed (the purpose) or how it’s processed (the means). Those decisions remain solely with the controller.

When you engage a cloud hosting company, email marketing platform, or payroll processor, the DPA specifies exactly what data they can access, what operations they perform, retention periods, and required security measures.

Security and Data Lifecycle

The processor must implement appropriate technical and organisational measures — encryption, access controls, security audits, staff training, and incident response procedures.

The DPA establishes procedures for the entire data lifecycle: how data is transferred to the processor, how it’s stored and secured, and what happens at the end of the relationship — whether data is deleted, returned, or retained under specific legal obligations.

Audit and Inspection Rights

The controller must be able to verify compliance — through direct audits, third-party assessments, or compliance certifications such as ISO 27001 or Cyber Essentials Plus.

Sub-Processor Management — The Chain of Accountability

If your processor wants to engage another processor (a sub-processor), they need your prior authorisation — either specific for each sub-processor or general with notification and objection rights. The processor remains fully liable for the sub-processor’s compliance.

Data Breach Response Under a DPA

The processor must notify you “without undue delay” upon discovering a breach. This is critical — you have only 72 hours to report certain breaches to the ICO, and any processor delay could cause you to miss that deadline.

DPAs work most effectively alongside non-disclosure agreements and broader business setup documentation.

---

What Are the Legal Requirements for a Data Processing Agreement UK?

Quick Answer: Article 28 of the UK GDPR prescribes eight mandatory elements, supplemented by ICO guidance and DUAA 2025 provisions. The agreement must be in writing (including electronic form). Verbal or informal arrangements don’t satisfy the requirement.

The Eight Mandatory Elements (Article 28(3))

1. Subject matter and duration — what data is processed and for how long.

2. Nature and purpose — why data is processed and what operations are performed.

3. Types of personal data and categories of data subjects — names, email addresses, financial data, plus whether they’re employees, customers, or website visitors. This prevents scope creep.

4. Controller’s obligations and rights — decision-making authority over processing, including the right to issue instructions, conduct audits, and terminate.

Processor-Specific Obligations

5. Confidentiality — authorised personnel must be bound by confidentiality obligations.

6. Security measures — appropriate technical and organisational measures as defined by Article 32, including pseudonymisation, encryption, ongoing testing, and effectiveness assessments. The level must be appropriate to the risk.

7. Sub-processor arrangements — prior written authorisation required. General authorisation allowed with notification and objection rights. The processor remains fully liable.

Assistance, Deletion, and Audit

The processor must assist with data subject rights requests, security obligations, breach notifications, and DPIAs. At the end of the relationship, all personal data must be deleted or returned. The controller gets audit and inspection rights.

DUAA 2025 Updates

Enhanced provisions for scientific research (including commercial), new automated decision-making safeguards, clarified international transfer rules using a “data protection test,” and a statutory right for individuals to complain directly to organisations about processing — requiring acknowledgement within 30 days.

What Happens If You Don’t Have One?

Failing to have an adequate DPA is a direct breach of Article 28. The ICO can impose fines on both controllers and processors. Beyond regulatory penalties, inadequate DPAs create significant liability in breach or privacy violation scenarios.

DPAs work most effectively when integrated with your complete documentation suite — including your employment documentation when processing employee data.

---

Can Data Processing Agreement Be Used by Disabled Employees?

Quick Answer: DPAs regulate the relationship between organisations (controller and processor), not the employment relationship. A disabled employee isn’t a party to a DPA — but their personal data may be processed under one, which triggers special category data protections.

Special Category Data — Enhanced Protections

Data relating to disability is special category data under Article 9 UK GDPR. Processing requires both a lawful basis (Article 6) and an additional Article 9 condition — typically substantial public interest under Schedule 1, Part 2, paragraph 18 of the Data Protection Act 2018.

Your DPA must explicitly acknowledge this and ensure enhanced security measures appropriate to the sensitivity.

Equality Act 2010 — How It Intersects

Employers must make reasonable adjustments under the Equality Act 2010. When these adjustments involve third-party processors — assistive technology providers, occupational health services, workplace assessment specialists — the DPA must ensure processing doesn’t create additional barriers or discrimination.

Review your employment documentation suite alongside data processing arrangements.

---

Are Data Processing Agreements Covered by UK Employment Law?

Quick Answer: Not directly. DPAs are governed by data protection law and contract law. But significant overlaps exist when processing employee data through third-party processors.

Where the Overlap Happens

Your payroll provider must be engaged under a DPA (data protection requirement), but the data relates to employment relationships (employment law), and the processing must comply with tax law (HMRC requirements). Multiple legal regimes apply simultaneously.

DPAs must enable compliance with employment law obligations — responding to subject access requests during Employment Tribunal proceedings, preserving employee data for statutory retention periods, and supporting reasonable adjustments for disabled employees.

DPAs should be considered alongside your employment law documentation and broader business legal framework.

---

Is Data Processing Agreement Tax Deductible for Businesses?

Quick Answer: Yes. Both legal fees for drafting DPAs and service fees paid to processors are typically allowable business expenses — they meet the “wholly and exclusively” test for business purposes.

What Qualifies as Deductible

Legal fees for drafting, reviewing, or updating DPAs are revenue expenses — fully deductible in the year incurred.

Service fees paid to processors (cloud hosting, payroll processing, CRM systems, marketing platforms) are trading expenses. A £1,200 annual cloud accounting fee is deductible as a software or professional services expense.

Corporation Tax Impact

For limited companies, DPA-related costs reduce taxable profits directly. £5,000 in DPA costs on £100,000 profit reduces the taxable figure to £95,000.

Maintain comprehensive records — copies of agreements, processor invoices, legal fee receipts, and documentation linking expenses to business purposes.

---

Do Data Processing Agreements Pay VAT in the UK?

Quick Answer: The agreement itself attracts no VAT (it’s a contract, not a supply). The data processing services provided under the agreement are typically subject to VAT at 20%.

Standard VAT Treatment

Most data processing services from UK processors to UK controllers attract standard rate VAT at 20% — cloud hosting, CRM platforms, payroll processing, email marketing, IT security services.

If VAT-registered, you reclaim this input VAT under the normal rules.

International Processors — Place of Supply

For B2B services, the general rule places supply where the customer belongs (reverse charge mechanism). A UK business using an EU-based processor typically accounts for VAT under reverse charge.

MTD for VAT requires digital records of all processing costs and correct reverse charge application where relevant.

---

How Does IR35 Affect Data Processing Agreement?

Quick Answer: IR35 determines employment status for tax purposes. DPAs address data protection obligations. They’re separate legal requirements that interact when contractors process personal data — and you must balance DPA control requirements against IR35 status factors.

The Two Separate Legal Questions

Consider a freelance IT consultant maintaining your CRM through their limited company. Two questions arise: (1) What’s their employment status under IR35? (2) Are they a data processor requiring a DPA?

Since April 2021, medium and large private sector organisations determine IR35 status. Small companies remain exempt.

The Control Paradox

IR35 examines control, substitution, mutuality of obligation, financial risk, and integration. DPAs require significant control over how processors handle data. Some DPA obligations overlap with IR35 control factors — but IR35 status must be determined independently based on the overall working relationship.

How to Structure the Documents

Maintain separate but complementary documentation: a Service Agreement covering commercial terms and IR35-relevant factors (deliverables, payment, IP, liability), and a Data Processing Agreement addressing UK GDPR Article 28 obligations.

For navigating this intersection, see your employment documentation framework.

---

What Insurance Is Needed for Data Processing Agreement?

Quick Answer: Professional Indemnity insurance (£1–10 million minimum), Cyber Liability insurance, and Employers’ Liability insurance (statutory minimum £5 million). Your DPA should specify minimum insurance requirements.

Professional Indemnity Insurance

Covers claims from professional negligence, errors, or omissions — accidental data deletion, misconfigured security, failure to implement agreed measures. Most UK processors maintain PI cover of £1–10 million.

Cyber Liability Insurance

Covers breach investigation, data subject notification, credit monitoring, legal fees, regulatory defence costs, fines (where insurable), and business interruption from cyber incidents.

What Your DPA Should Specify

Require processors to maintain PI and Cyber cover with specified minimums, provide evidence before commencing processing, confirm coverage annually, and notify you if insurance is cancelled or materially reduced.

---

Is Data Processing Agreement GDPR Compliant?

Quick Answer: Compliance depends entirely on contents and implementation. Simply having a document titled “Data Processing Agreement” provides no guarantee — it must contain all eight Article 28(3) elements and be properly executed.

The Minimum Standard

All eight mandatory elements from Article 28(3) must be present: subject matter, duration, nature, purpose, data types, data subjects, controller rights, processor obligations, sub-processor controls, deletion provisions, and audit rights. Missing any element = non-compliant.

Beyond Minimum — What the ICO Recommends

Detailed security specifications (encryption standards, access controls, testing protocols), breach notification procedures with specific timeframes, liability and indemnity provisions, termination rights, governing law clauses, and provisions addressing DUAA 2025 updates.

DUAA 2025 — What Compliant DPAs Should Now Address

Enhanced automated decision-making safeguards (if relevant), scientific research provisions, updated international transfer mechanisms, support for recognised legitimate interests, and statutory complaints handling procedures.

Your DPA should sit alongside your privacy policy, cookie policy, and terms and conditions as part of your complete website legal documentation.

---

How to Handle Data Breaches with Data Processing Agreement

Quick Answer: The processor must notify you “without undue delay” (specify 24–48 hours maximum in your DPA). You then have 72 hours to report to the ICO if necessary. The DPA should specify exactly what breach information the processor must provide.

The Notification Timeline — Why Every Hour Matters

Under Articles 33 and 34, controllers must report certain breaches to the ICO within 72 hours. But you can only meet this if processors notify you promptly. Any processor delay consumes your available assessment time.

Your DPA should specify maximum 24–48 hours from discovery to notification.

What Information Must the Processor Provide?

Description of the breach (what, when, how discovered), categories and approximate numbers of data subjects affected, categories and numbers of personal data records, likely consequences, measures taken or proposed, and an assessment of whether ICO/data subject notification is required.

Cost Allocation — Who Pays?

Breach response is expensive — forensic investigation, legal advice, ICO representation, PR management, credit monitoring, system remediation. Your DPA should clearly allocate costs based on responsibility for the breach.

---

What Are the Health and Safety Requirements for Data Processing Agreement?

Quick Answer: H&S requirements become relevant when data processing involves physical premises, equipment, or personnel activities. Data centres must comply with fire safety, electrical safety, and emergency access regulations. Processors working at your premises must follow your site safety rules.

Data Centres and Physical Infrastructure

Processors operating server facilities must comply with the Regulatory Reform (Fire Safety) Order 2005, electrical safety standards, ventilation and temperature control requirements, and emergency access/egress provisions.

When Processor Staff Visit Your Premises

Under the Health and Safety at Work etc. Act 1974, you have obligations as premises controller. Your DPA should require processor personnel to comply with site safety rules, hold necessary certifications, use appropriate PPE, and report safety incidents.

---

Can Data Processing Agreement Be Used by Contractors?

Quick Answer: Yes — and they should be. Whenever a contractor processes personal data on your documented instructions, they’re a data processor regardless of employment status or tax treatment. This triggers Article 28.

Common Contractor Processing Scenarios

IT contractors accessing employee or customer data. Marketing contractors processing customer lists. HR contractors handling recruitment records. Finance contractors managing client financial data. All require a DPA.

Two Documents, Not One

You need a Service Agreement covering commercial terms, deliverables, payment, and IP — plus a Data Processing Agreement addressing UK GDPR Article 28 obligations. These work alongside an NDA covering broader confidentiality.

---

How to Create a Data Processing Agreement Legally in the UK

Quick Answer: Map your processing activities, conduct processor due diligence, draft with all eight Article 28(3) elements, define measurable security requirements, and include standard contractual provisions. The agreement must be in writing.

Step 1: Map Your Processing Activities

Document what data will be processed, why, how, where (including international transfers), who accesses it, retention periods, and security measures. Don’t use generic “personal data” — be specific about data types.

Step 2: Conduct Processor Due Diligence

Article 28(1) requires controllers to use only processors providing “sufficient guarantees.” Review security certifications, data protection track records, insurance coverage, technical capabilities, and client references.

Step 3: Draft the Core Agreement

Include all eight mandatory elements. Start with party identification, comprehensive definitions, and specifications for subject matter, duration, nature, purpose, data types, and data subjects.

Step 4: Define Security Measures — Be Specific

Don’t rely on vague language. Specify measurable standards: encryption type and key length, access control mechanisms, security monitoring frequency, physical security requirements, incident response timeframes, backup procedures, and testing schedules.

Step 5: Include Standard Contractual Provisions

Governing law, dispute resolution, termination rights, amendment procedures, and notice provisions.

---

What Are the Benefits of Data Processing Agreement?

Quick Answer: Beyond regulatory compliance, DPAs provide clear liability allocation, contractual remedies for processor failures, documented due diligence evidence, enhanced security standards, competitive advantage, and trust-building between business partners.

Clarity of Responsibilities

Without a DPA, disputes easily arise about who should have implemented security measures, who bears breach notification responsibility, what deletion obligations exist, and how incident costs are allocated.

Competitive Advantage

Buyers increasingly require evidence of comprehensive DPAs, detailed security certifications, established breach response procedures, and proven compliance records. Robust data protection practices win contracts.

Enhanced Security Through Dialogue

Negotiating a DPA forces both parties to articulate and implement specific security measures. Controllers define expectations. Processors demonstrate capability. This dialogue elevates security practices beyond what might exist without formal requirements.

---

What Are the Best Practices for Data Processing Agreement?

Quick Answer: Start with comprehensive data mapping, implement tiered DPA frameworks based on risk, treat DPAs as living documents, integrate with procurement, conduct regular audits, and document everything.

Tiered DPA Frameworks — Not All Processors Are Equal

Enhanced DPAs for high-risk processing (special category data, large volumes, international transfers). Standard DPAs for moderate-risk. Streamlined DPAs for low-risk processing.

Living Documents — Schedule Annual Reviews

DPAs should evolve with your relationship. Implement change management for when processing activities change, security requirements evolve, legislation updates occur, or processor systems change.

Exercise Your Audit Rights

Don’t wait for problems. Schedule routine audits of critical processors. Use third-party auditors for high-risk relationships. Verify security implementation. Test breach notification procedures through exercises.

Document Everything

Maintain negotiation history, due diligence materials, audit reports, breach notifications, change requests, and compliance certifications. Retain for at least six years.

---

Frequently Asked Questions: Data Processing Agreement UK

What is a data processing agreement?

A legally binding contract required by UK GDPR Article 28 between a data controller and data processor. It specifies how personal data will be processed, what security measures will be implemented, and what obligations each party must fulfil.

What are the 7 principles of the DPA?

The seven data protection principles under UK GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability. These must be reflected in Data Processing Agreements.

Do data processing agreement workers get holiday pay?

DPAs regulate controller-processor relationships, not employment. Workers employed by data processors receive holiday pay from their employer (the processor), not the controller. Employment law — not the DPA — determines employment rights.

Can data processing agreement be claimed as business expense?

Yes. Legal fees for drafting DPAs and service fees paid to processors are typically allowable business expenses — incurred wholly and exclusively for business purposes and necessary for legal compliance.

What happens to data processing agreement after Brexit?

The UK implemented its own UK GDPR (substantially mirroring EU GDPR) and the Data Use and Access Act 2025. DPAs remain mandatory. The UK maintains an adequacy decision with the EU, though regimes are gradually diverging in some areas.

What data protection applies to data processing agreement?

UK GDPR, Data Protection Act 2018, and DUAA 2025. DPAs must address Article 28 requirements including security measures, breach notification, data subject rights assistance, sub-processor controls, and audit rights.

Do data processing agreement workers need DBS checks?

Depends on the nature of work, not the DPA. If processor personnel work with children or vulnerable adults, DBS checks may be legally required. The DPA should specify any necessary background checking requirements.

When should you use data processing agreement?

Whenever you engage a third party to process personal data on your behalf — cloud services, IT contractors, payroll providers, marketing agencies, CRM platforms, or any service provider that accesses, stores, or processes personal data under your instructions.

How to choose the right data processing agreement?

Base the choice on processing risk. High-risk (special category data, large volumes, international transfers) requires comprehensive DPAs with detailed security specifications. Moderate-risk uses standard DPAs. Low-risk may use streamlined templates. All must include the eight Article 28(3) elements.

What records must be kept for data processing agreement?

Executed DPAs, due diligence materials, security certifications, audit reports, breach notifications, sub-processor approvals, data deletion certificates, insurance certificates, and annual review documentation. Retain for at least six years.

---

The Truth About “Free” Legal Template Sites (What You’re Really Signing Up For)

Most websites offering a “free legal template” follow the same pattern:

• You click because it’s advertised as free
• You spend 10–15 minutes answering questions
• At the very end, you must create an account or start a “free trial”
• Your card is required upfront
• The subscription auto-renews at £29–£39 per month

This isn’t a free template — it’s a subscription service. Many people only realise after being charged £300–£400 over the year.

Why These “Free” Templates Are a Legal Risk

• Outdated wording: not aligned with current UK law
• Missing mandatory clauses: required for legal validity
• No compliance guidance: leaving users without legal context
• No structured checklist: no way to verify the document works
• Not kept updated: often unchanged when legislation changes

One incorrect clause can weaken or invalidate the entire document.

Hidden Problem: Many “Free Template” Sites Aren’t Even UK-Based

Another major issue is that many free or auto-subscription template sites operate outside the UK and use documents originally drafted for the US legal system. These are then loosely adapted for “international use,” which creates serious problems:

• Incorrect terminology: taken from US contract law
• Missing UK statutory references: essential legal requirements omitted
• Non-applicable clauses: terms that don’t apply under UK legislation
• Legal conflicts: risks breaching UK consumer, employment, or GDPR rules

Why Templates UK Does the Opposite

• Drafted by UK professionals: written by experienced business & legal experts
• UK-law only: no US crossover or generic “international” templates
• One-time price from £10: no subscriptions, no renewals
• Full preview: see the exact document before buying
• Lifetime access: free lifetime updates included

My Templates Dashboard

All purchased templates are stored in your personal My Templates page, organised by category.

When we update a template for UK law changes, the new version appears automatically in your dashboard — free, forever.

Build a growing library of UK legal documents across every area of your business and personal life.

Transparent Pricing

From £10 per template — with free lifetime usage and free lifetime updates. No subscriptions. No renewals. No auto-billing.

Not ready to buy? Use our free interactive checklists to guide your own document — no payment required.

No tricks. No trials. No hidden fees. Just the exact UK-specific legal document you came for — at the price we told you upfront.

Build your own bespoke document with our Data Processing Agreement Template. Preview the full document before buying — only pay when you’re happy with it.

---

Get Every Template in One Bundle

The UK Legal Templates Ultimate Bundle includes 91 templates across every category — one purchase, lifetime updates, no subscriptions.

---

Explore Template Bundles by Category

One purchase, lifetime updates, no subscriptions.

• Business Complete Suite — 37 templates, £120 (smaller packs available)
• Landlord Ultimate Bundle — 28 templates, £99 (smaller packs available)
• Complete Family Pack — 18 templates, £65 (smaller packs available)
• Complete Estate Pack — 8 templates, £38 (smaller packs available)

Browse all bundles →

---

Explore the Master Business Legal Templates Pillar Guide

The complete overview of 37 essential UK business templates.

UK Business Legal Templates — Complete Master Guide

---

Explore All Templates UK Pillar Guides

• Family Law Documents Guide UK
• Wills & Estate Planning Guide UK
• Residential Landlord Documents Guide UK
• Employment Documents Guide UK
• How to Set Up a Business in the UK — Legal Guide
• Website Legal Documents UK — Compliance Guide
• Financial & Commercial Contracts UK — Protection Guide
• Commercial Office Lease Guide UK
• Digital & IP Agreements Guide UK

---

Related Guides

• Privacy Policy Guide UK
• Cookie Policy Guide UK
• Terms and Conditions Guide UK
• Non-Disclosure Agreement Guide UK

---

Free Legal Templates & Interactive Checklists

Access all our free UK legal templates, checklists and downloadable PDFs.

Browse Free Templates →

Last updated: February 2026

Disclaimer: This guide provides general UK legal information, not legal advice. Laws are current as of February 2026.