This Data Processing Clause has been designed for use in a wide range of
documents to assist with data protection compliance (including the UK GDPR). This clause covers the processing
of personal data by one party on the other party’s behalf (i.e. the
processing of data by a data processor on behalf of a data controller). Two
versions of the clause are available in this document – one for use with
agreements, the other for use in terms and conditions.
This document has been updated for compatibility with the UK GDPR. It is ready for use from the start of 2021.
This clause can be used alone or in combination with a Data Protection
Two main options are provided in each of these clauses. The first simply
refers to a separate Data Processing Agreement, meaning that all the
details and obligations of the data processing will be addressed there,
leaving just a simple two-part clause here. The second option is a complete
set of basic data processing clauses. The choice of which approach to take
is yours to make; but we would suggest that the set of clauses should be
used for simpler data processing services, while a full data processing
agreement would be more appropriate for more complex situations given its
higher level of detail.
If option one is to be used, neither the definition of “Data Protection
Legislation” nor the schedule need to be inserted into your document. If
option two is used in the “agreement version” of the clause, both the
definition and the schedule must be used as well. If the “terms and
conditions version” is used, there is no schedule, only the definition.
(Note when inserting definitions, the tables of definitions in our
templates use tables with invisible borders.)
Each clause contains various form fields for you to complete which refer to
the names (that is, the names used throughout the main document) of the
parties to the document into which the clause is being inserted (be it an
agreement or a set of terms and conditions). If the second option is used –
the set of clauses – the “main” names given to the parties in the document
are temporarily replaced by “Data Controller” and “Data Processor”. This
has been done partly to make the clause simpler to edit, and partly to make
it absolutely clear which party bears which responsibilities from a data
protection perspective. Furthermore, in the terms and conditions version of
the clause, the main contract (i.e. that which will be entered into by the
parties on the basis of the terms and conditions) is also referred to by
name. This should be completed using the appropriate term from the template
you are editing.
Once you have purchased access to the appropriate document folder click on
the “Download Document” link below. You will be asked what you want to do
with the file. It is recommended that you save the document to a location
of your choice prior to viewing.