Data Processing Agreement (UK)

This Data Processing Agreement (UK) is designed for use where a UK data processor processes personal data on behalf of a UK data controller only within the United Kingdom.

It is intended to sit alongside a separate service agreement or similar contract under which the services include the processing of personal data.

The template has been written to assist with compliance under the UK GDPR and the Data Protection Act 2018, providing a contractual framework for UK-only controller-processor arrangements.

When to use this agreement

Use this template where both the controller and processor are UK-based and the processing takes place only within the UK.

If the processor is located in the EEA, see Data Processing Agreement (UK to EEA). If the processor is located outside the EEA, see Data Processing Agreement (UK to Non-EEA).

What the agreement covers

Data processing agreements of this type are intended to regulate the processor’s handling of personal data and to reflect the key controller-processor requirements under UK data protection law.

• the subject matter, nature, purpose, and duration of the processing;
• the types of personal data and categories of data subjects involved;
• the requirement for the processor to act only on the controller’s written instructions;
• confidentiality and training obligations for personnel handling personal data;
• security of processing and appropriate technical and organisational measures;
• controls on subcontracting and equivalent obligations for subcontractors;
• assistance with data subject rights, personal data breaches, impact assessments, and related compliance matters;
• deletion, disposal, and end-of-contract handling of personal data; and
• audit and inspection rights to help verify compliance.

Risk allocation and structure

The agreement also includes provisions on warranties, liability, and indemnity, drafted to strike a balance between the controller and processor.

Its clauses deal with scope, data protection compliance, data subject requests and complaints, personal data breaches, staff, warranties, liability, intellectual property rights, confidentiality, subcontractors, deletion or disposal of personal data, consideration, and governing law.

The schedules cover the services, the personal data involved, and the technical and organisational data protection measures.

Data Processing Agreement (UK) is part of Business . Just £38.50 + VAT provides unlimited downloads from Business for 1 year.