Data Protection & Data Processing Clauses

Many commercial agreements and terms and conditions involve personal data in some way. Rather than rewriting a full agreement, it is often helpful to insert a small set of standard clauses that bring the document into line with UK data protection law, including the UK GDPR and the Data Protection Act 2018.

This collection contains standalone clauses designed to be inserted into a wide range of agreements and terms and conditions with minimal alteration.

When Should You Use These Templates?

Use these clauses where your contract refers to personal data and you want to document the parties’ data protection responsibilities clearly. In particular:

use the Data Protection Clause where the agreement needs a general data protection provision and a clear reference to your Privacy Notice;
use the Data Processing Clauses where one party will process personal data on the other party’s behalf (a controller and processor arrangement).

What Templates Are Included?

Data Protection Clause

A standard clause for use in a wide range of agreements and terms and conditions, stating that personal data will be used in accordance with the law and referring to a Privacy Notice for full details.

Data Processing Clauses

A controller and processor clause designed to assist with UK GDPR compliance where one party processes personal data on the other party’s behalf. Two versions are included: one for agreements and one for terms and conditions.

Why Use These Templates?

These clauses help you add appropriate data protection wording to existing commercial documents without turning them into heavy, standalone data protection agreements. They are particularly useful where you want consistent, reusable wording across multiple templates and customer contracts, with a clear split between general data protection wording and specific controller and processor requirements.

For more information about each document in this collection, please click on the links below:

Data Protection & Data Processing Clauses is part of Business . Just £38.50 + VAT provides unlimited downloads from Business for 1 year.

Frequently Asked Questions

I just need data protection wording for a contract, not a full agreement, what do I use? +

Use standalone clauses rather than a separate agreement. Where a contract simply refers to personal data, a short data protection clause can state that data will be handled in line with the law and point to your privacy notice. Where one party will process data for the other, you need fuller data processing clauses. This sub-folder provides both, drafted to slot into a wide range of agreements and terms with minimal changes.

When do I need data processing clauses rather than a general data protection clause? +

Use the general data protection clause where the contract merely involves personal data and you want to confirm lawful handling and refer to your privacy notice. Use the data processing clauses where one party will actually process personal data on the other's behalf, because that is a controller to processor arrangement and the UK GDPR requires specific Article 28 terms. The test is whether one party is handling data under the other's instructions.

Do these clauses satisfy the Article 28 processor requirements? +

The data processing clauses are drafted to help meet the Article 28 mandatory terms, covering processing on instructions, confidentiality, security, sub-processors, assistance with rights and breaches, plus deletion or return. They still have to be completed and tailored to your arrangement, and for complex or high value processing a full standalone data processing agreement may be a better fit. Treat the clauses as a compliant starting point you adapt, not a guarantee.

Can I drop these clauses into any contract? +

They are designed to be inserted into a wide range of agreements and terms and conditions with minimal alteration, and there are versions aimed at both formal agreements and terms and conditions. You still need to check they fit the specific contract, define the data and purposes where the clause calls for it and make sure they do not conflict with other terms. Used carefully they give you consistent, reusable data protection wording across your contracts.

Business Buy Only £38.50 + VAT!
Unlimited Downloads for One Year
No Auto-Renewal

Complementary Templates

Working with Contracts

All UK GDPR & Data Protection