Data Processing Agreements

When you engage a third party to process personal data on your behalf, the UK GDPR requires the arrangement to be governed by a written contract with specific mandatory terms. These are commonly referred to as data processing agreements.

This collection contains standalone data processing agreement templates for different processing and transfer scenarios, plus an International Data Transfer Agreement template for use where personal data is transferred to countries outside the United Kingdom and the European Economic Area.

When Should You Use These Templates?

Use these templates if you are a data controller and you are appointing a data processor to carry out processing for you, and you want a robust written agreement covering key UK GDPR requirements, including:

the subject matter, nature, purpose, and duration of the processing;
security measures and confidentiality obligations;
rules on sub-processors, assistance with data subject rights, and breach support; and
where relevant, the additional safeguards required for transfers of personal data to countries outside the United Kingdom and the European Economic Area.

These templates can be used as standalone agreements, or alongside a separate service agreement (with options included for both approaches).

What Templates Are Included?

Data Processing Agreement (UK to EEA)

For use where a UK controller appoints a processor located in the United Kingdom or the European Economic Area. Transfers to the European Economic Area can continue unrestricted, and this template includes detailed processor obligations and schedules.

Data Processing Agreement (UK to Non-EEA)

For use where a UK controller appoints a processor located outside the European Economic Area. This template addresses the controller-processor requirements and includes schedules for recording the lawful basis and safeguards for transfers, with space for inserting a completed International Data Transfer Agreement where needed.

Data Processing Agreement (UK)

For use where both controller and processor are UK-based and processing takes place only within the United Kingdom, designed to sit alongside a separate service agreement or similar contract.

International Data Transfer Agreement

A template copy of the Information Commissioner’s International Data Transfer Agreement for transfers to “third countries”. It is designed to be used alongside a data processing agreement, not instead of one.

Why Use These Templates?

These templates help you put the correct contractual framework in place for different processing and transfer scenarios, without relying on generic clauses that may not fit your arrangements.

They also include schedules and optional wording designed to help you record key information about the processing and align responsibilities clearly between controller and processor, including security, sub-processing, breach support, and assistance with data subject rights.

For more information about each document in this collection, please click on the links below:

Data Processing Agreements is part of Business . Just £38.50 + VAT provides unlimited downloads from Business for 1 year.

Business Buy Only £38.50 + VAT!
Unlimited Downloads for One Year
No Auto-Renewal