Data Processing Agreements

When you engage a third party to process personal data on your behalf, the UK GDPR requires the arrangement to be governed by a written contract with specific mandatory terms. These are commonly referred to as data processing agreements.

This collection contains standalone data processing agreement templates for different processing and transfer scenarios, plus an International Data Transfer Agreement template for use where personal data is transferred to countries outside the United Kingdom and the European Economic Area.

When Should You Use These Templates?

Use these templates if you are a data controller and you are appointing a data processor to carry out processing for you, and you want a robust written agreement covering key UK GDPR requirements, including:

the subject matter, nature, purpose, and duration of the processing;
security measures and confidentiality obligations;
rules on sub-processors, assistance with data subject rights, and breach support; and
where relevant, the additional safeguards required for transfers of personal data to countries outside the United Kingdom and the European Economic Area.

These templates can be used as standalone agreements, or alongside a separate service agreement (with options included for both approaches).

What Templates Are Included?

Data Processing Agreement (UK to EEA)

For use where a UK controller appoints a processor located in the United Kingdom or the European Economic Area. Transfers to the European Economic Area can continue unrestricted, and this template includes detailed processor obligations and schedules.

Data Processing Agreement (UK to Non-EEA)

For use where a UK controller appoints a processor located outside the European Economic Area. This template addresses the controller-processor requirements and includes schedules for recording the lawful basis and safeguards for transfers, with space for inserting a completed International Data Transfer Agreement where needed.

Data Processing Agreement (UK)

For use where both controller and processor are UK-based and processing takes place only within the United Kingdom, designed to sit alongside a separate service agreement or similar contract.

International Data Transfer Agreement

A template copy of the Information Commissioner’s International Data Transfer Agreement for transfers to “third countries”. It is designed to be used alongside a data processing agreement, not instead of one.

Why Use These Templates?

These templates help you put the correct contractual framework in place for different processing and transfer scenarios, without relying on generic clauses that may not fit your arrangements.

They also include schedules and optional wording designed to help you record key information about the processing and align responsibilities clearly between controller and processor, including security, sub-processing, breach support, and assistance with data subject rights.

For more information about each document in this collection, please click on the links below:

Data Processing Agreements is part of Business . Just £38.50 + VAT provides unlimited downloads from Business for 1 year.

Frequently Asked Questions

When do I need a data processing agreement? +

Whenever you let another organisation process personal data on your behalf, the UK GDPR requires a written contract with specific terms, commonly called a data processing agreement. That applies to suppliers such as cloud providers, payroll bureaux, IT support and marketing agencies who handle your data under your instructions. It is not optional and a handshake or a plain service agreement without the required data protection terms will not meet the requirement.

What must a processor contract contain? +

Article 28 sets mandatory terms. The processor must act only on your documented instructions, keep the data confidential and secure and use a sub-processor only with your authorisation. It must help you respond to individuals' rights and to breaches, submit to audits and delete or return the data at the end. A good template builds all of these in, so the contract does the compliance work rather than leaving gaps.

We are sending data to a supplier outside the UK, what extra is needed? +

Sending personal data outside the UK is a restricted transfer, which needs a lawful transfer route on top of your processor contract. You can rely on UK adequacy for countries the UK recognises, or put appropriate safeguards in place such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. These templates include agreements for non EEA processors and a copy of the International Data Transfer Agreement for that purpose.

Can we still send personal data to the EU freely? +

Yes. The European Economic Area is covered, so transfers of personal data from the UK to the EEA can continue without extra safeguards. Flows the other way are also secure: in December 2025 the European Commission renewed its UK adequacy decisions, so personal data can move freely between the EEA and the UK until late 2031. You still need your Article 28 processor terms, but no special transfer mechanism for EEA processors.

What is the difference between a processing agreement and a data sharing agreement? +

It turns on who decides what happens to the data. A data processing agreement is for a processor acting only on your instructions, such as a supplier running a service for you. A data sharing agreement is for two organisations that each use the data as controllers for their own purposes. If your supplier is following your instructions you need a processing agreement, if the other party is doing its own thing with the data you need a sharing agreement.

Business Buy Only £38.50 + VAT!
Unlimited Downloads for One Year
No Auto-Renewal