A Data Processing Agreement (DPA) is a contract between a data controller and a data processor. The controller decides why and how personal data is processed, while the processor handles that data on the controller’s instructions. Harper James is a UK full-service commercial law firm advising businesses on the laws of England and Wales, including data protection matters.
A DPA is required where a processor handles personal data for a controller under the UK GDPR. It is commonly included in a SaaS agreement, outsourcing contract, payroll arrangement, marketing services agreement or managed IT services contract. The agreement should describe the processing clearly, including the subject matter, duration, nature, purpose, types of personal data and categories of data subjects.
The UK GDPR requires a DPA to address how the processor processes personal data and protects it. Key terms cover documented instructions, confidentiality, security measures, assistance with individual rights, support with data protection impact assessments, personal data breach management, and deletion or return of data at the end of the services.
The DPA should also state whether the processor can appoint sub-processors. A practical arrangement identifies approved sub-processors, sets an approval or notification process for future appointments, and requires the processor to impose equivalent data protection obligations on them. The controller should also check where processing takes place and whether personal data is transferred outside the United Kingdom. Any international transfer requires a lawful transfer mechanism and appropriate safeguards.
A business reviewing a DPA should compare it with the main commercial agreement and the supplier’s technical documentation. The documents should use consistent definitions, identify the correct parties, and allocate responsibility for security incidents, regulatory enquiries and individual data requests. Liability provisions also require careful review because a DPA does not automatically determine the financial consequences of a breach.
After signature, the DPA should be recorded in the organisation’s data protection documentation and reflected in operational procedures. The controller should maintain a processor register, review suppliers when services or processing activities change, track sub-processors, and confirm that deletion or return obligations are completed when the relationship ends. A template is useful for routine arrangements, but material processing, international transfers and high-risk data require a contract tailored to the actual service.