Data Processing Agreement Template

UK GDPR Article 28(3) specifies mandatory provisions for data processing agreements. Your DPA must include:

Required Clauses:

• Subject matter and duration: What processing is covered and how long
• Nature and purpose: Why data is being processed
• Type of personal data: Categories of data being processed
• Categories of data subjects: Whose data is involved (customers, employees, etc.)
• Controller obligations and rights: Your instructions and oversight powers
• Processor obligations: Confidentiality, following instructions, security
• Sub-processor rules: When and how sub-processors can be used
• Security measures: Technical and organisational protections
• Assistance with rights: Helping you respond to data subject requests
• Breach notification: How and when processor notifies you of breaches
• Audit rights: Your ability to verify compliance
• Data deletion/return: What happens when processing ends

Our template includes all Article 28 requirements with clear guidance.

Data Controller (Usually You):

• Decides WHY personal data is collected and processed
• Decides HOW personal data is processed
• Has primary responsibility under UK GDPR
• Must have appropriate agreements with processors
• Example: Your business collecting customer email addresses for marketing

Data Processor (Your Supplier):

• Processes personal data ON BEHALF OF the controller
• Must follow the controller's documented instructions
• Cannot use data for their own purposes
• Must implement appropriate security measures
• Example: Mailchimp sending marketing emails using your customer list

Sub-Processor:

• A processor engaged by your processor
• Requires your prior authorisation (general or specific)
• Must be bound by same data protection obligations
• Example: Your email provider using a cloud hosting service

Comprehensive DPA Coverage:

• ✓ Party identification (controller and processor)
• ✓ Definitions section
• ✓ Subject matter and duration of processing
• ✓ Nature and purpose of processing
• ✓ Types of personal data processed
• ✓ Categories of data subjects
• ✓ Controller's instructions
• ✓ Processor confidentiality obligations
• ✓ Security measures requirements
• ✓ Sub-processor provisions
• ✓ Data subject rights assistance
• ✓ Breach notification procedures
• ✓ Audit and inspection rights
• ✓ International transfer provisions
• ✓ Data deletion and return
• ✓ Liability and indemnification
• ✓ Term and termination

Related documents: Businesses typically also need Privacy Policy, Cookie Policy, and Terms & Conditions.

Mistakes That Risk GDPR Compliance:

• No DPA at all: Many businesses share data with processors without any written agreement — this is a direct Article 28 violation
• Using generic contracts: Standard service agreements don't contain required Article 28 provisions
• Vague processing descriptions: "Processing data as needed" doesn't meet the specificity requirements
• Missing sub-processor provisions: No rules on when and how processors can engage sub-processors
• No audit rights: Controller must retain ability to verify processor compliance
• Inadequate breach notification: Must specify how and when processor reports breaches to you
• No deletion requirements: What happens to data when processing ends must be documented
• Ignoring international transfers: If processor uses servers outside UK, additional safeguards required

Our template covers all requirements with clear, structured clauses.