Harper James advises UK businesses on data protection contracts and commercial arrangements under the laws of England and Wales. A UK GDPR data processing agreement (DPA) sets out how a processor handles personal data for a controller and is required where Article 28 applies.
The DPA should identify the controller, processor and any approved sub-processors. It should describe the subject matter, duration, nature and purpose of processing, the types of personal data involved, and the categories of data subjects. The processor must process personal data only on the controller’s documented instructions, including instructions about international transfers. The agreement should also establish a process for changing instructions and dealing with unlawful or conflicting requirements.
The processor must commit to appropriate technical and organisational measures, such as access controls, encryption, resilience, backup procedures, confidentiality obligations and security testing. The DPA should require the processor to notify the controller of a personal data breach without undue delay and provide sufficient information for the controller to assess notification duties to the Information Commissioner’s Office and affected individuals. It should also require the processor to ensure that staff with access to personal data are subject to confidentiality obligations.
The processor must provide reasonable assistance with data subject rights, including subject access requests, erasure, rectification and restrictions on processing. The DPA should cover assistance with data protection impact assessments, regulatory enquiries, audits and evidence of compliance. It should specify how the processor supports the controller in meeting its security and breach-management obligations, including response times and the information to be provided.
A DPA should state whether the processor needs specific or general authorisation to appoint sub-processors. It should require notice of proposed changes and give the controller an opportunity to object where the arrangement permits this. The processor remains responsible for ensuring that its sub-processors comply with equivalent data protection obligations.
International transfers require separate controls where personal data leaves the UK. The contract should identify the transfer mechanism, such as UK International Data Transfer Agreements or the UK Addendum to the EU Standard Contractual Clauses, and address transfer risk assessments where relevant. On termination, the processor must generally delete or return personal data at the controller’s choice, unless UK law requires continued storage. The main commercial agreement should separately address confidentiality, liability, indemnities, insurance, audit costs and the consequences of a security incident, because these matters are not fully determined by Article 28.