If your business provides services that involve handling personal data on behalf of clients, you are likely acting as a data processor. Many organisations process personal data in this way, often without realising the legal responsibilities that come with it.
As a data processor, you have distinct legal obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. These duties are separate from those of a data controller. Failing to meet them can expose your organisation to serious consequences, including regulatory enforcement, legal claims, reputational damage, and in some cases, criminal penalties.
Understanding and fulfilling your obligations is essential, not only to minimise legal risk, but also to maintain trust with your clients and uphold high standards of data protection.
In this article, our data protection solicitors outline the key responsibilities of UK-based data processors and how we can help you comply with UK GDPR if you are a data processor.
Contents:
Understanding your role – controller, processor, or both?
Your role under data protection law depends on how you handle personal data in practice:
- You are a data controller if you decide how and why personal data is used.
- You act as a processor if you only handle data based on a controller’s instructions. Being a processor means you have no autonomy about how personal data is used – this is all up to the controller, who calls the shots.
If your service delivery gives you access to the personal data of a controller, then you’re likely a processor:
- You have access to your client’s systems, which contain personal data.
- You handle payroll data provided by your client, using it solely for payroll purposes.
- You store customer data as part of a service, e.g. in hosting or support, but don’t use that data for your purposes.
- You carry out customer-dictated tasks, such as email marketing or analytics, by using the data and instructions provided by your client.
You can be a controller and a processor for different activities, too. You might be a processor when you deliver email campaigns for a client using a client’s contact list, but at the same time, a controller when you send marketing messages to your clients for your own business. Your role depends on the context and level of control you have over personal data.
In some situations, you and another party may jointly determine the purposes and means of processing. In this case, you are joint controllers, and additional considerations will apply.
It is essential that you accurately determine each party’s role in a data processing scenario, as this will directly dictate the legal obligations that arise under data protection law. If you’re unsure of your role, it’s essential to take legal advice to make sure you don’t fall foul of your obligations.
Your responsibilities as a data processor
As a data processor, you have specific responsibilities under the UK GDPR:
- Use data protection law-compliant processing terms: You must have a written contract with each client that outlines how you process their data. The contract must include specific legal terms as outlined in Article 28 of the UK GDPR. These terms describe what data you’ll handle, what you’re allowed to do with it, and what happens when the work ends.
You can include these terms in your main service agreement or as a separate data processing agreement (DPA).
While you’ll need minimum terms prescribed by law, you may find yourself heavily negotiating a range of data processing terms and commercial terms – e.g. around liability and security measures. - Follow written instructions: You must only process personal data in accordance with your controller client’s written instructions. If you use it differently or for your purposes, you might be deemed a controller, which brings about additional legal obligations.
If your client gives you an instruction you believe is unlawful, then you should raise this with them immediately. - Protect personal data with security measures: You are responsible for protecting personal data by implementing appropriate technical and organisational measures to safeguard the data you hold against cyber attacks or data breaches. The specific measures you choose must be justified based on your risks and circumstances. Common examples include:
- Passwords and access controls
- Encryption
- Multi-factor authentication (MFA)
- Staff training and awareness
- Regular risk assessments and reviews
Failure to implement sufficient security can have serious consequences. For example, the Information Commissioner's Office (ICO) fined a data processor over £3 million for failing to use multi-factor authentication. This highlights that even processors must prioritise robust data security. - Train your staff: Ensure that your staff understand and are trained on how to handle personal data safely, and receive training on key issues, including what constitutes personal data, how to protect it, and how to report concerns. Staff working with large volumes or sensitive data may need more detailed training, depending on their role. Only authorised personnel should process personal data, and they should be bound by confidentiality obligations too.
- Keep records of processing activities: You should keep a clear, written record of your processing activities, e.g. what data you handle, who it’s for, where it’s stored, whether it’s transferred internationally, and how you protect it. Even if you qualify for an exemption from mandatory record-keeping, maintaining this practice is still advisable. It shows that you take data protection seriously and highlights your accountability. It could also arise in client due diligence from your controllers, for example, when your clients inquire about whether you maintain accurate and up-to-date records of processing.
- Help your controllers meet their legal duties: You need to support controllers in complying with specific legal responsibilities, e.g., if a controller requires input on a data protection impact assessment. You must be prepared and able to assist when asked.
- Report data breaches to the controller: If something goes wrong and there’s any personal data breach (e.g. data is lost, shared by mistake, or accessed without permission), you must inform your controller client without undue delay. They have just 72 hours from becoming aware to report reportable breaches to the ICO, so time matters. Some contracts set even stricter timelines, e.g. immediately – so check carefully what you’ve agreed to and when you’re negotiating timelines for reporting breaches, make sure you can stick to them in practice.
- Use only approved sub-processors: If you want to bring in another business to help you deliver services and process personal data (e.g. a subcontractor who handles some aspects of the project), you must get written authorisation from your controller client first. This can either be prior specific authorisation or general authorisation. Several critical rules apply when appointing sub-processors, and you are fully responsible to the controller for their actions. Therefore, run due diligence to ensure they are UK GDPR compliant, enter robust subcontracting agreements with them, and verify that they comply with their obligations.
- Manage international transfers lawfully: If you transfer or access personal data from outside the UK (e.g. when you send a client’s data to a third-party supplier overseas), you must follow the UK GDPR rules on international transfers. Depending on the destination of the data, you may require additional safeguards, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as well as a Transfer Risk Assessment. It’s vital to know where data will be shared and to ensure it is protected when it leaves the UK.
- Appoint a data protection officer (DPO) if required: You must appoint a DPO if:
- Your core work involves large-scale, regular, and systematic monitoring of individuals or the processing of sensitive data related to crimes and criminal convictions.
- You’re a public authority (except courts acting in a judicial role), or
- Your DPO will need to report to senior management, act independently, and have expert knowledge of data protection law. You’ll need to provide them with the necessary resources for their role. Even if you don’t legally need one, you can choose to appoint a DPO voluntarily as best practice.
While these reflect core obligations of processors, you will also need to take other steps, such as cooperating with data protection regulators like the ICO when necessary.
The ICO is very clear about what responsibilities and liabilities processors have under UK GDPR.
Why GDPR compliance matters for data processors
Compliance with GDPR is critical for both legal and commercial reasons.
- Legal risks: As a processor, failing to meet your responsibilities under UK GDPR can lead to serious consequences, including significant fines, legal claims, reputational damage, and even criminal penalties in extreme cases. You may also face contractual liabilities – for example, where you have agreed to indemnify a data controller for your breaches.
- Commercial value: Clients, business partners, investors, and other stakeholders expect processors to demonstrate strong data protection practices. Meeting your obligations indicates that you are a credible and trustworthy supplier, which helps you build and maintain valuable business relationships. Robust compliance can give you a commercial edge, particularly where data protection is a deciding factor for clients handling high-risk information. As a supplier, being prepared for due diligence questions on your data practices can set you apart from competitors and can help you secure contracts.
Common mistakes to avoid
One of the biggest pitfalls for processors is assuming that only the controller is responsible for GDPR compliance. While controllers do bear many obligations, processors also have direct duties under the law.
Key mistakes include:
- Confusing roles: Not recognising when you are acting as both a controller and a processor, leading to missed or muddled obligations.
- Poor contracts: Using generic, non-compliant data processing agreements.
- Sub-processor mismanagement: Failing to appoint or manage sub-processors properly in line with legal requirements.
- Neglecting staff training: Leading to avoidable data breaches.
- Misunderstanding controller duties: For example, believing processors must provide privacy notices to data subjects (this is the controller’s responsibility).
Avoiding these pitfalls and taking a proactive, knowledgeable approach to compliance will help protect your business, legally and commercially.
How legal advice can help
There is a lot of misinformation out there, and the UK GDPR is a topic that can cause uncertainty and risk non-compliance. That’s why investing in expert legal advice, which is tailored to your business, is critical.
It’s essential to map out your data flows and thoroughly understand your data processing activities, enabling you to determine your specific legal obligations and identify the applicable rules for your business.
Legal advice will help you understand the applicable rules, the steps you need to take (e.g., which processes or policies to implement), and how to mitigate risk as a processor. This is particularly important where you’re a service provider delivering services to multiple clients, meaning there is even greater scope for increased liability.
If you're unsure about your responsibilities under data protection law, our expert data protection solicitors can help you. They can develop tailored policies, systems, and training to ensure compliance and to safeguard both your business and the personal data you handle.
