Data Processing Agreement Template (UK)
Create Your Professional Contract in Minutes

Under GDPR Article 28 and UK Data Protection Act 2018, your Data Processing Agreement must include:

• Subject matter and duration: Clear description of processing activities and agreement term
• Nature and purpose of processing: Detailed explanation of what processing will occur and why
• Type of personal data: Categories of personal data being processed (names, emails, addresses, etc.)
• Categories of data subjects: Who the data relates to (customers, employees, website visitors, etc.)
• Controller obligations and rights: Instructions for processing and controller's audit rights
• Processor obligations: Including confidentiality, security measures, sub-processor requirements, data subject rights assistance, breach notification, deletion/return of data
• Security measures: Technical and organisational measures (encryption, access controls, etc.)
• Sub-processor requirements: Written authorization for sub-processors and flow-down obligations
• International transfers: Safeguards for transfers outside UK/EEA (if applicable)
• Breach notification: Obligation to notify controller without undue delay
• Data subject rights: Assistance with access requests, erasure, portability, etc.
• Audit rights: Controller's right to audit processor's compliance
• Deletion or return: Obligation to delete or return data at end of processing

Our template includes all mandatory Article 28 provisions for full GDPR compliance.

ICO Enforcement Powers:

• Tier 2 administrative fines: Up to £17.5 million or 4% of annual global turnover (whichever is higher) for Article 28 violations
• Joint and several liability: Both controller and processor can be liable for GDPR breaches
• Enforcement notices: ICO can order immediate compliance and corrective actions
• Processing bans: ICO can prohibit specific processing activities
• Compensation claims: Data subjects can sue for damages caused by non-compliant processing
• Audits and investigations: ICO can conduct detailed audits of processing arrangements

Real ICO Actions:

British Airways (£20m fine) and Marriott (£18.4m fine) both involved processor relationships without adequate contractual safeguards. The ICO specifically identified missing or inadequate Data Processing Agreements as contributing factors.

Every data controller using third-party processors MUST have compliant DPAs in place.

Get compliant today for just £10.

Full GDPR Article 28 & UK DPA 2018 Compliance:

• ✓ Comprehensive definitions (Controller, Processor, Data Subject, Personal Data, Processing, etc.)
• ✓ Subject matter, nature, purpose, and duration clause
• ✓ Types of personal data and categories of data subjects
• ✓ Controller instructions and obligations
• ✓ Processor obligations (confidentiality, security, assistance, notification)
• ✓ Technical and organisational security measures (TOMs)
• ✓ Sub-processor authorization and requirements
• ✓ International data transfer safeguards (Standard Contractual Clauses references)
• ✓ Data subject rights assistance obligations
• ✓ Personal data breach notification procedures
• ✓ Data Protection Impact Assessment (DPIA) assistance
• ✓ Audit and inspection rights
• ✓ Deletion or return of personal data
• ✓ Records of processing activities
• ✓ Processor warranties and representations
• ✓ Liability and indemnification clauses
• ✓ Term and termination provisions
• ✓ Governing law (England & Wales / Scotland / Northern Ireland)

Professional, legally sound, and ready to sign.

Don't Fall Into These Traps:

• No written DPA at all: Verbal agreements or email exchanges do NOT satisfy GDPR requirements. You must have a written, signed contract.
• Using processor's generic terms: Third-party processors often provide inadequate DPAs that don't meet Article 28. Controllers must ensure full compliance.
• Missing mandatory clauses: Every Article 28(3) requirement must be explicitly addressed. Missing even one clause = non-compliance.
• Vague processing instructions: "Process as necessary" is insufficient. Instructions must be specific, documented, and lawful.
• No sub-processor controls: Processors must obtain prior written authorization before engaging sub-processors. Flow-down obligations are mandatory.
• Inadequate security measures: Must specify actual technical and organisational measures (encryption, access controls, etc.), not just "appropriate security".
• Missing breach notification timelines: Must specify "without undue delay" notification requirement to controller.
• No audit rights: Controllers must retain rights to audit and inspect processor's data protection practices.
• Forgetting data deletion: Must require return or deletion of personal data at end of processing.
• Using US DPA templates: US data processing agreements don't include GDPR-specific requirements and won't protect you.
• No international transfer safeguards: If processor uses servers outside UK/EEA, must include Standard Contractual Clauses or equivalent.

Our template prevents all these mistakes with comprehensive GDPR-compliant clauses.