Data Processing Agreement UK: UK GDPR Article 28 Template (Word, PDF)

A data processing agreement (often shortened to DPA) governs one specific relationship: a controller, who decides why and how personal data is used, and a processor, who uses that data only on the controller's instructions. The controller is usually the customer. A dental practice that keeps patient records in a hosted practice management system is the controller; the software company that runs the servers is the processor. The DPA records what the processor may do with the data, why, for how long, and what happens if something goes wrong. Some suppliers call it a data processing addendum; the label makes no legal difference.

The document is not a privacy notice, which tells individuals how you use their data, and it is not a data sharing agreement between two controllers who each use the data for their own ends. If your supplier decides for itself how to use the information (a recruitment agency choosing which candidates to approach, for example), it is a controller in its own right and a processor contract is the wrong tool. A non-disclosure agreement does not fill the gap either. A mutual or one-way NDA for UK businesses protects confidential business information, but it says nothing about instructions, sub-processors or deletion, which are the points the regulator checks.

The core rule sits in Article 28 of the UK GDPR, the UK's own version of the regulation, read with the Data Protection Act 2018 and amended most recently by the Data (Use and Access) Act 2025. Under Article 28(1), a controller may only use processors that provide sufficient guarantees of appropriate technical and organisational measures. Article 28(3) then requires a binding contract that sets out the subject matter and duration of the processing, its nature and purpose, the types of personal data, the categories of data subjects and the controller's rights and obligations. The same paragraph lists eight things the processor must commit to: acting only on documented instructions, confidentiality of staff, security under Article 32, the rules on sub-processors, help with requests from individuals, help with security, breaches and impact assessments under Articles 32 to 36, deletion or return of the data at the end, and audits. The full wording is on the official text of Article 28 UK GDPR on legislation.gov.uk.

Three further rules shape the drafting. Article 28(9) says the contract must be in writing, including in electronic form, so an e-signed PDF is fine. Article 33(2) obliges the processor to report a breach to the controller "without undue delay", while the controller has 72 hours, where feasible, to tell the regulator. Transfers outside the UK now follow Article 44A and the data protection test in Article 46(6): protection after the transfer must not be "materially lower" than under UK law, assessed reasonably and proportionately, typically with the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Breach reports now go to the Information Commission, which replaced the Information Commissioner as regulator.

The short answer is whenever a supplier touches personal data you are responsible for. The obvious cases are technology contracts. Managed IT support with remote access, website hosting, cloud storage, a CRM or booking system, an email marketing platform: each one processes your customers' or staff's data, and the supplier is a processor. An online retailer is a typical example: its online shop terms and conditions for UK consumers promise customers careful handling of their orders, and the e-commerce platform, the email tool and the fulfilment partner all need a DPA behind that promise. Outsourced business functions come next, such as payroll bureaus, bookkeepers who run your PAYE, call centres, mailing houses, document scanning and secure shredding firms. A freelancer can be a processor too. If you engage a self-employed developer or virtual assistant under a UK contractor agreement and they work inside your customer database, the contractor agreement covers the work and the DPA covers the data.

Large software providers push their own standard terms; the template earns its keep with smaller suppliers who have no DPA at all. Two edge cases deserve attention. When the processor is based abroad, the data leaves the UK the moment you send it, so the transfer safeguards apply from day one. When the data includes health information, biometrics or criminal records, the security bar rises and the agreement should say so expressly.

The agreement runs to 18 clauses and two annexes. Annex 1 holds the description of the processing that Article 28(3) requires; Annex 2 lists the security measures, from multi-factor authentication to tested back-ups. The clauses that do most of the work in a dispute are these:

• Sub-processors can be refused entirely, approved from a named list, or authorised generally with 30 days' notice and a 14-day right to object; once you object, the new supplier may not touch the data until the objection is resolved.
• A personal data breach must be reported without undue delay and within a fixed deadline you choose (24, 48 or 72 hours), with the details the controller needs for its own report.
• Where data goes abroad, clause 8 ties every transfer to Article 44A, names the IDTA and the UK Addendum, and requires a written assessment of the data protection test.
• Audit rights start with certifications and questionnaires, then allow one inspection a year on 30 days' notice, more often after a breach.
• At the end, the controller chooses return or deletion, and back-up copies must disappear within 90 days.

Liability follows Article 82: each party answers to individuals under the statute, and the one that pays compensation can recover the other's share. You can keep the caps in your main contract or set a figure for this agreement. No cap ever limits liability for fraud, death or personal injury caused by negligence, or the rights of the individuals concerned.

You start by identifying the two parties. For a company, LLP or CIO, the form asks for the registered name, place of registration, number and office address, then the person signing; for a sole trader or a partnership, the name with any trading name and the business address. Next comes the main contract: either its title and date, or a reference to the quotation, order form or terms of business under which you buy the service.

The middle of the questionnaire builds Annex 1. You describe the services, what the supplier does with the data, the purpose, the types of personal data and whose data it is. Separate screens deal with sensitive data, the duration, extra security measures, sub-processors and transfers outside the UK. If you list a sub-processor in Ireland or the United States, answer "Yes" to the transfer question as well, because the EEA counts as outside the UK even though UK regulations approve it. You finish with the breach deadline, whether assistance is charged, the liability cap and the two data protection contacts. The preview on the right updates as you go. Keep the signed copy with your other business contract templates so the next review is quick.

The most frequent error is a DPA that describes the processing in one vague line ("customer data for the services"). Article 28(3) asks for types of data and categories of individuals, and a vague annex invites the question whether the contract meets Article 28 at all. The second mistake is forgetting the sub-processors. Your IT firm almost certainly uses a hosting provider, a back-up service and a remote access tool, and each of them must appear in the list or be approved under the general authorisation. A third problem is copying an EU template that cites the EU regulation, EU supervisory authorities and the EU standard contractual clauses without the UK Addendum. The transfer clauses will then be wrong.

Timing causes the rest of the trouble. Businesses often sign the DPA months after the supplier started work, which leaves a period with no Article 28 contract at all; sign it before any data is shared, or date it on signature and treat the gap as a compliance point to record. Another classic is a 72-hour breach deadline for the processor, which gives the controller the facts late and little time to contain the incident. Finally, check your privacy notice. Your website privacy policy and cookie policy should describe the categories of recipients, including the processors you sign with, and it must match the agreements you actually have.