Loading the contract library
A controller-to-processor data processing agreement under the UK GDPR and the Data Protection Act 2018, with every Article 28(3) term, UK transfer rules as amended by the Data (Use and Access) Act 2025, and balanced, Controller-leaning and Processor-leaning positions on the negotiated points.
England & Wales
Highlighted blanks are the details your parties fill in.
This agreement is dated the date on which it is signed by the last of the parties.
This agreement is made between [TO BE CONFIRMED — Controller] (the "Controller") and [TO BE CONFIRMED — Processor] (the "Processor").
"Services Agreement" means [TO BE CONFIRMED — Services Agreement].
"Data Protection Laws" means the UK GDPR, the Data Protection Act 2018 and any other law of the United Kingdom relating to the processing of personal data, as amended or replaced from time to time.
Explore more templates in this category or region.
"Personal Data" means any personal data that the Processor processes on behalf of the Controller in connection with the Services Agreement.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
"Sub-processor" means any processor engaged by the Processor to process Personal Data.
"UK GDPR" has the meaning given in the Data Protection Act 2018. Other terms defined in Data Protection Laws and used in this agreement, including "personal data", "processing", "data subject", "special category data" and "supervisory authority", have the same meanings here.
For the Personal Data, the Controller is the controller and the Processor is the processor. This agreement forms part of the Services Agreement and applies for as long as the Processor processes Personal Data. The Processing Details schedule sets out the subject matter and duration of the processing, its nature and purpose, the types of Personal Data and the categories of data subjects.
The Controller is responsible for having a lawful basis for the processing and for giving data subjects the information Data Protection Laws require. Its instructions must comply with Data Protection Laws. Before the processing starts, and whenever the risk changes, the Controller must tell the Processor about any special category or criminal offence data and any other risk to individuals that the Processor needs to know to protect the Personal Data.
The Processor must process Personal Data only on the Controller's documented instructions, including with regard to transfers of Personal Data outside the United Kingdom, unless domestic law requires it to do otherwise. If domestic law requires other processing, the Processor must tell the Controller of that legal requirement before processing, unless that law prohibits this on important grounds of public interest. The Controller's instructions are this agreement, the Services Agreement and any further written instructions it gives that are consistent with them.
The Processor must immediately tell the Controller if, in its opinion, an instruction infringes Data Protection Laws. The Processor may suspend the affected processing until the Controller confirms, changes or withdraws the instruction. If the Controller maintains an instruction that the Processor reasonably considers unlawful, either party may terminate the affected services on written notice.
The Processor must ensure that each person it authorises to process Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, and that access is limited to those who need it to perform the Services Agreement.
The Processor must implement and maintain the measures in the Security Measures schedule and any other measures required by Article 32 of the UK GDPR, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risk to individuals. The Processor must regularly test and review those measures. It may update them, provided no update materially reduces the overall level of protection.
The Controller gives general written authorisation for the Processor to engage the Sub-processors listed in the Approved Sub-processors schedule and others notified under this clause. The Processor must notify the Controller in writing of any intended addition or replacement at least 30 days before it takes effect, identifying the Sub-processor, its location and the processing it will perform. The Controller may object on reasonable data protection grounds within that period, and the parties must then discuss the objection in good faith. If it is not resolved before the change takes effect, the Controller may terminate the affected services on written notice and receive a refund of charges prepaid for the period after termination.
Before a Sub-processor processes Personal Data, the Processor must bind it by a written contract imposing the same data protection obligations as this agreement, in particular sufficient guarantees of appropriate technical and organisational measures. The Processor remains fully liable to the Controller for the performance of each Sub-processor's obligations. On request, the Processor must give the Controller a copy of the relevant data protection terms, which may be redacted to protect confidential commercial information.
Taking into account the nature of the processing, the Processor must assist the Controller by appropriate technical and organisational measures, so far as possible, to respond to requests from data subjects to exercise their rights under Data Protection Laws. If the Processor receives such a request directly, it must forward it to the Controller within 5 working days and must not respond except on the Controller's documented instructions or as the law requires.
If the Processor receives an inquiry or request from a person other than the Controller concerning the processing of Personal Data, including a judicial, administrative or regulatory order or a request from a data subject, it must notify the Controller unless domestic law prohibits notice. The Processor must not respond without the Controller's prior consent except as domestic law requires. To the extent permitted by domestic law, the Processor must follow the Controller's reasonable instructions, including by providing status updates and other reasonably requested information. The Processor must cooperate with and provide reasonable assistance to the Controller, at the Controller's expense, in any legal response or other procedural action concerning the Processor's processing of Personal Data.
Taking into account the nature of the processing and the information available to it, the Processor must assist the Controller in meeting its obligations under Articles 32 to 36 of the UK GDPR, covering security of processing, notifying Personal Data Breaches to the Information Commission and to data subjects, data protection impact assessments and prior consultation with the Information Commission. The Controller must pay the Processor's reasonable charges, agreed in advance, for assistance beyond the services under the Services Agreement, unless the assistance is needed because of the Processor's breach of this agreement.
The Processor must notify the Controller of a Personal Data Breach without undue delay, and in any event within 48 hours, after becoming aware of it. The notice must describe, so far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed to address it, and a contact point for more information. The Processor must give further information in phases, without undue delay, as it becomes available.
The Processor must promptly take reasonable steps to contain, investigate and mitigate a Personal Data Breach and must cooperate with the Controller's response. Unless the law requires otherwise, the Processor must not notify any supervisory authority, data subject or other third party of a Personal Data Breach without the Controller's prior written approval. A notification or response by the Processor is not an admission of fault or liability.
The Processor must not transfer Personal Data to a country or international organisation outside the United Kingdom, including by allowing access from outside the United Kingdom, except on the Controller's documented instructions and in compliance with Chapter V of the UK GDPR. The Controller instructs transfers to the processing locations in the Processing Details schedule and to Sub-processors authorised under the Sub-processors clause at their notified locations. The Processor must tell the Controller without undue delay if it can no longer comply with this clause for any transfer.
Before any transfer of Personal Data that is not approved by regulations under Article 45A of the UK GDPR, the parties must put in place an appropriate safeguard under Article 46 of the UK GDPR, such as the International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission's standard contractual clauses, in the current version issued under section 119A of the Data Protection Act 2018. The exporter must carry out a transfer risk assessment showing that the data protection test in Article 46 is met, and the importer must give it the information it reasonably needs. The Processor must ensure the same for any transfer to or by a Sub-processor.
The Processor must make available to the Controller all information necessary to demonstrate compliance with Article 28 of the UK GDPR and this agreement, and must allow for and contribute to audits, including inspections, by the Controller or an independent auditor it mandates. The Controller must give at least 30 days written notice, and audits may take place no more than once in any 12-month period unless a Personal Data Breach, a supervisory authority or reasonable evidence of non-compliance requires otherwise. The Controller must take account of current independent audit reports or certifications the Processor provides when deciding the audit's scope. Audits must take place during business hours, with minimal disruption and under reasonable confidentiality and security conditions. Each party bears its own costs, unless the audit reveals a material breach by the Processor, which must then reimburse the Controller's reasonable audit costs and promptly remedy the breach.
The Controller may share a copy of the Processor’s audit reports with relevant government authorities as required upon their request.
The Processor must retain records of its compliance with this agreement for three years after this agreement ends.
When the provision of services relating to the processing ends, the Processor must, at the Controller's choice, delete or return all Personal Data to the Controller within 30 days and delete existing copies, unless domestic law requires storage. If the Controller does not choose within that period, the Processor must delete it. Personal Data the Processor must store remains protected under this agreement, may be processed only for the purpose requiring storage, and must be deleted when that requirement ends. On request, the Processor must confirm deletion in writing.
The Processor must enable the Controller to delete Personal Data in a manner consistent with the functionality of the Services Agreement and must comply with that instruction as soon as reasonably practicable, except where domestic law requires further storage of the Personal Data.
Each party's liability arising out of or in connection with this agreement is subject to the limitations and exclusions of liability in the Services Agreement, and claims under this agreement and the Services Agreement count together towards any cap. Nothing in this agreement limits or excludes liability to data subjects under Article 82 of the UK GDPR, or any liability that cannot be limited or excluded by law.
Any claim against the Processor or its Affiliates arising out of or in connection with this agreement may be brought only by the Controller entity that is a party to the Services Agreement.
This agreement continues until the Processor has stopped processing Personal Data and has returned or deleted it under the Return and Deletion clause. If the Processor breaches this agreement or Data Protection Laws, the Controller may instruct it to suspend the affected processing until the breach is remedied. The Controller may terminate the affected services under the Services Agreement on written notice if the Processor commits a material breach of this agreement that cannot be remedied or is not remedied within 30 days after written notice.
If this agreement conflicts with the Services Agreement on the processing of Personal Data, this agreement prevails, and any transfer safeguard entered into under the International Transfers clause prevails over both. Notices under this agreement are given as the Services Agreement provides, but Personal Data Breach notifications and data subject requests may also be sent to the privacy contacts in the Processing Details schedule.
If a change in Data Protection Laws, or guidance or a decision of the Information Commission or a court, requires a change to this agreement, the parties must negotiate in good faith and agree the minimum change needed.
A person who is not a party to this agreement has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any of its terms. This does not affect any right a data subject has under Data Protection Laws.
This agreement and any dispute or claim, including any non-contractual dispute or claim, arising out of or in connection with it are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction to settle any such dispute or claim.
Subject matter: the Processor's provision of the services described in the Services Agreement. Duration: the term of the Services Agreement and any later period until the Personal Data is returned or deleted under the Return and Deletion clause. Nature of the processing: [TO BE CONFIRMED — Nature of the processing (the operations performed)]. Purpose: [TO BE CONFIRMED — Purpose of the processing]. Types of Personal Data: [TO BE CONFIRMED — Types of personal data]. Special category or criminal offence data, and the additional safeguards applied: none. Categories of data subjects: [TO BE CONFIRMED — Categories of data subjects]. Processing locations: the United Kingdom. Controller privacy contact: [TO BE CONFIRMED — Controller privacy contact]. Processor privacy contact: [TO BE CONFIRMED — Processor privacy contact].
The Processor must implement at least the following technical and organisational measures: access to Personal Data limited to personnel who need it, with unique user accounts and multi-factor authentication for administrative and remote access; encryption of Personal Data in transit over public networks and at rest where appropriate to the risk; logging and monitoring of access to systems that hold Personal Data; vulnerability management, patching and malware protection; backups and tested recovery procedures; a documented incident-response procedure; confidentiality undertakings and data protection training for personnel; physical security for premises and equipment used for the processing; and regular testing and evaluation of the effectiveness of these measures.
Sub-processors authorised at the date of this agreement (name, location and processing performed): none.