Harper James is a UK full-service commercial law firm advising businesses on data protection and the laws of England and Wales. A Data Processing Agreement (DPA) sets out how a processor handles personal data for a controller and supports the parties’ compliance with the UK GDPR and the Data Protection Act 2018.
Start by identifying each party’s role. A controller determines why and how personal data is processed, while a processor acts on the controller’s documented instructions. The agreement should describe the processing, including its subject matter, duration, purpose, categories of personal data and categories of data subjects. It should also identify whether any party acts as an independent controller or joint controller for particular activities, since a processor agreement is not appropriate for every data-sharing arrangement.
The DPA should require processing only on documented instructions and should address confidentiality, staff access, security measures and assistance with data subject rights. The parties should agree a workable process for reporting personal data breaches, responding to subject access requests, completing impact assessments and dealing with regulatory enquiries. Security wording should be sufficiently specific to assess performance, covering measures such as access controls, encryption, resilience, testing and incident management where relevant to the service.
The processor’s use of subprocessors should be addressed expressly. The contract should state whether the controller gives general or specific authorisation, how much notice is required for a new subprocessor, and how objections are handled. If personal data leaves the UK, the DPA should identify the transfer mechanism and the responsibilities for transfer risk assessments and supplementary safeguards. The commercial contract should also make clear where the relevant data is hosted and which entities provide the service.
The DPA should work with the main services agreement on indemnities, liability caps, insurance, audit rights and costs. Audit rights need practical limits covering notice, frequency, confidentiality and alternative evidence such as independent certifications. On termination, the agreement should require the processor to return or securely delete personal data, subject to clearly stated legal retention duties, and provide a process for confirming completion. Before signing, the business should compare the DPA against its privacy notice, security controls, supplier arrangements and actual data flows, so that the contract reflects the service being delivered.