Data Processing Clauses
This Data Processing Clause has been designed for use in a wide range of documents to assist with data protection compliance (including the UK GDPR). This clause covers the processing of personal data by one party on the other party’s behalf (i.e. the processing of data by a data processor on behalf of a data controller). Two versions of the clause are available in this document – one for use with agreements, the other for use in terms and conditions.
This document has been updated for compatibility with the UK GDPR. It is ready for use from the start of 2021.
This clause can be used alone or in combination with a Data Protection Clause.
Two main options are provided in each of these clauses. The first simply refers to a separate Data Processing Agreement, meaning that all the details and obligations of the data processing will be addressed there, leaving just a simple two-part clause here. The second option is a complete set of basic data processing clauses. The choice of which approach to take is yours to make; but we would suggest that the set of clauses should be used for simpler data processing services, while a full data processing agreement would be more appropriate for more complex situations given its higher level of detail.
If option one is to be used, neither the definition of “Data Protection Legislation” nor the schedule need to be inserted into your document. If option two is used in the “agreement version” of the clause, both the definition and the schedule must be used as well. If the “terms and conditions version” is used, there is no schedule, only the definition. (Note when inserting definitions, the tables of definitions in our templates use tables with invisible borders.)
Each clause contains various form fields for you to complete which refer to the names (that is, the names used throughout the main document) of the parties to the document into which the clause is being inserted (be it an agreement or a set of terms and conditions). If the second option is used – the set of clauses – the “main” names given to the parties in the document are temporarily replaced by “Data Controller” and “Data Processor”. This has been done partly to make the clause simpler to edit, and partly to make it absolutely clear which party bears which responsibilities from a data protection perspective. Furthermore, in the terms and conditions version of the clause, the main contract (i.e. that which will be entered into by the parties on the basis of the terms and conditions) is also referred to by name. This should be completed using the appropriate term from the template you are editing.
Once you have purchased access to the appropriate document folder click on the “Download Document” link below. You will be asked what you want to do with the file. It is recommended that you save the document to a location of your choice prior to viewing.